Re: [TLS] Fate of resumption

[Peter Gutmann <[e-mail]>]

Yoav Nir <[e-mail]> writes:

>This trend started with HTTP/1.1, but it’s now common for TLS sessions to
>last for many minutes as long as the browser window remains open.Since the
>original session lasts and lasts, there is less use for resumption.

And the important point here is "browser window remains open".  Vast numbers
of TLS uses aren't browsers (it's the universal substrate for secure
connections over the net), they close and reopen the connection as needed.
Dropping resume would be a catastrophic performance hit for them.  I've worked
with devices that have cache expiry times of 24 hours or more, the planning
for them is that the high-overhead initial full handshake is something they
have to put up with in order to bootstrap an entry in the session cache, at
which point they can operate normally.

>With HTTP/2 poised to get deployed on much of the Internet, 

Given its embedded-device-hostile nature (and the http-ng WG's response of
"let them eat HTTP 1.1"), it may get widely deployed for the browser-based
web, but I don't know about everything else.

Peter.