Re: [TLS] What would make TLS cryptographically better for TLS 1.3

[Nikos Mavrogiannopoulos <[e-mail]>]

On 11/03/2013 06:18 PM, Ralf Skyper Kaiser wrote:

>     * A TLS connection can be established by a fully trusted device which
>     knows a password or other application-layer authorization credential,
>     authorized to perform some operations using messages within the TLS
>     connection, and then transferred with the help of renegotiation to a
>     less trusted device to actually perform those operations.  This is
>     similar to the preceding use, but to provide 'sideways secrecy' rather
>     than forward secrecy.
> Renegotiation comes at a huge cost of complexity (not just from a
> development point of view but also from a security audit point of view).
> All features of re-negotiation can be achieved by re-connecting.
> Re-connecting is well understood, easily tested and audited.

The fact that renegotiation is available in almost all implementations,
says that the cost is not as huge as you mention. You also seem to imply
that renegotiation is as secure as terminating a connection and
re-establishing another one. It is not.

regards,
Nikos