IETF Logo Mail Archive

Re: [TLS] Re: when is it ok to resume a cached SSL/TLS session

Eric Rescorla <ekr@networkresonance.com> Mon, 15 January 2007 17:12 UTC

Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1H6VNX-0003OQ-PC; Mon, 15 Jan 2007 12:12:15 -0500
Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1H6VNW-0003OK-Te for tls@ietf.org; Mon, 15 Jan 2007 12:12:14 -0500
Received: from raman.networkresonance.com ([198.144.196.3]) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1H6VNU-0004h7-Jr for tls@ietf.org; Mon, 15 Jan 2007 12:12:14 -0500
Received: by raman.networkresonance.com (Postfix, from userid 1001) id 1835F1E8C28; Mon, 15 Jan 2007 09:12:12 -0800 (PST)
To: home_pw@msn.com
Subject: Re: [TLS] Re: when is it ok to resume a cached SSL/TLS session
References: <20070115154600.A77285C01E@laser.networkresonance.com> <BAY126-DAV649C9E2DAC40983624F6292B50@phx.gbl> <86ac0ke02o.fsf@raman.networkresonance.com> <BAY126-DAV7527528284E612011A4A192B50@phx.gbl>
From: Eric Rescorla <ekr@networkresonance.com>
Date: Mon, 15 Jan 2007 09:12:11 -0800
In-Reply-To: <BAY126-DAV7527528284E612011A4A192B50@phx.gbl> (home pw's message of "Mon, 15 Jan 2007 09:05:42 -0800")
Message-ID: <86lkk4ciz8.fsf@raman.networkresonance.com>
User-Agent: Gnus/5.1007 (Gnus v5.10.7) XEmacs/21.4.19 (berkeley-unix)
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
X-Spam-Score: 0.0 (/)
X-Scan-Signature: 7655788c23eb79e336f5f8ba8bce7906
Cc: tls@ietf.org
X-BeenThere: tls@lists.ietf.org
X-Mailman-Version: 2.1.5
Precedence: list
Reply-To: EKR <ekr@networkresonance.com>
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.lists.ietf.org>
List-Unsubscribe: <https://www1.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@lists.ietf.org?subject=unsubscribe>
List-Archive: <http://www1.ietf.org/pipermail/tls>
List-Post: <mailto:tls@lists.ietf.org>
List-Help: <mailto:tls-request@lists.ietf.org?subject=help>
List-Subscribe: <https://www1.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@lists.ietf.org?subject=subscribe>
Errors-To: tls-bounces@lists.ietf.org

<home_pw@msn.com> writes:

>> Peter,
>>
>> TLS session IDs do not come with any guarantee that the server will
>> actually honor a resumption request. The server may implement any
>> session cache policy it chooses. Therefore the client *must* be
>> prepared for the server to refuse resumption.
>>
>> -Ekr
>
> So the only thing we are disagreeing on is the definition of "must be
> prepared".
>
> You say choked, I say graceful fail.

No, I don't agree with this analysis. The server being unwilling
to resume a session is normal behavior. The TLS state machine
explicitly handles such cases. Implementations which choke
rather than doing a full handshake are broken.

-Ekr


_______________________________________________
TLS mailing list
TLS@lists.ietf.org
https://www1.ietf.org/mailman/listinfo/tls

v2.23.0 | Report a Bug | By Email