Re: [TLS] Proposed text for removing renegotiation

[Brian Smith <[e-mail]>]

On Wed, May 28, 2014 at 3:00 AM, Yoav Nir <[e-mail]> wrote:

> On May 28, 2014, at 8:47 AM, Brian Smith <[e-mail]> wrote:
>
> On Tue, May 27, 2014 at 2:39 PM, Martin Thomson <[e-mail]>wrote:
>
>> It's not possible to just remove renegotiation.
>>
>
> Why not? What is the motivation for keeping any form of renegotiation,
> even rekeying? It isn't clear from the public mailing list discussions what
> is motivating the rekeying feature. (Perhaps I overlooked something; if so,
> a link to the past decision on this would be appreciated.)
>
> 1. Client Authentication.
>

<snip>

> Martin has a couple of drafts for making this happen in a combination of
> HTTP authentication method (“go away and come back with a certificate”) and
> a TLS extension (“I have a certificate. Please send a CertReq”).
>

FWIW, I think the idea that Martin is pursuing is the right approach to
this issue.


> 2. Connections that carry so much traffic and last so very long that you
> really need to rekey. This was discussed at the meeting, partially on
> Jabber ([1]). It’s not that common for the web, but I’m assured that XMPP
> connections sometimes last basically forever, so they need rekeying. My
> proposal there (at 19:40) was for this use case. Martin is right that it
> adds “dead air”, but all these use cases are not that delay sensitive, and
> I think it’s worth it to get the simplified state machine.
>

As you say, these applications are not delay sensitive. Also, these
applications have to be able to recover from long-lived connections being
broken. So, for these applications, why isn't it acceptable to just close
the connection/session and open a new one?

I think it would be helpful to see some examples of real-world applications
(preferably, but not exclusively open source) that actually do currently
use renegotiation to rekey a long-lived connection.

Assuming rekeying would be an optional feature like renegotiation is, would
web browsers and/or common web servers actually implement rekeying? It
would be very tempting to leave it out to reduce the chance of
implementation mistakes if it were optional.

Cheers,
Brian