Re: [TLS] Proposed text for removing renegotiation

[Martin Thomson <[e-mail]>]

On 9 June 2014 00:34, Nikos Mavrogiannopoulos <[e-mail]> wrote:
> Could somebody elaborate on what is that issue and why does it need to
> be solved? (it is not even mentioned in the TLS 1.3 charter) As someone
> who follows the mailing list that proposal comes out of the blue with no
> context whatsoever.


I think that this has been covered in the thread, but piecemeal:

* Renegotiation is a major source of security issues, both of the "we
screwed the TLS design up" sort and of the "my application didn't
realize that these things could change" sort.  There is a clear desire
to remove features that enable either sort of problem.

* Renegotiation is just more protocol complexity.  Removing it
potentially makes implementations simpler.

I think that either might be sufficient justification for removing the feature.

However, a number of use cases depend on renegotiation to achieve
their ends.  Of these, we have identified:

* mid-session client authentication, which uses renegotiation seems to
only be used in HTTP

* very long-lived connections, which require renegotiation to re-key
occasionally

The former we have decided to solve in HTTP.  As a side note, we just
decided to forbid renegotiation in HTTP/2.

The latter can be addressed by my proposal, or any of a number of mechanisms.