[TLS] make ChangeCipherSpec a handshake message

[Hauke Mehrtens <[e-mail]>]

Why is ChangeCipherSpec a special type and not just a handshake message?
It is only send in the handshake and preceded and followed by handshake
messages.

DTLS has some functionality for reordering of handshake messages. All
the handshake messages have a message_seq field which is used to bring
the messages into the right order again and detect duplicates. The
messages can get into the wrong order if they are send independently and
not the hole flight in one turn. This gets even messier when the
packages are getting retransmitted. When packages are getting
retransmitted all packages from a flight are getting retransmitted even
if just one of these packages were not received. With the message_seq
field one can detect if this package was already received and what is
the next package to handle.

The ChangeCipherSpec package does not have a message_seq field, but it
also has to get reordered and retransmitted like the handshake packages.

RFC 6347 already says there is a problem in DTLS:
https://tools.ietf.org/html/rfc6347#section-4.2.5

I worked on a DTLS 1.2 implementation some time ago and there I had to
do some magic to support reordering of the ChangeCipherSpec message.

My proposal for TLS 1.3 is to make ChangeCipherSpec a normal handshake
message. This should make DTLS implementations based on TLS 1.3 easier
and TLS 1.3 gets rid of one special case. When this gets changed the
enum in the ChangeCipherSpec message can get removed as it only contains
one static value. The ChangeCipherSpec message would be similar to the
ServerHelloDone message.

Hauke