Re: [TLS] Substitute for renegotiation in TLS 1.3

[Ilari Liusvaara <[e-mail]>]

On Mon, Feb 23, 2015 at 10:46:29AM +0000, Albe Laurenz wrote:
> While researching a renegotiation problem I saw that TLS 1.3 has done away
> with this feature altogether.
>
> However, in a later commit
> (https://github.com/tlswg/tls13-spec/commit/21099bc7ff338d8deae6c3ae832f03dff29840c2)
> ChangeCipherSpec was removed, and I can neither find the discussion leading
> to that nor any mention in the commit how "rekey" should be accomplished now.
> 
> Does that mean that there is no possibility to renegotiate any more?
> That would be unfortunate for my use case (encrypted database connections which
> can last arbitrarily long).
> Moreover, it would go against the consensus on the list, as quote above.

Current editor's copy does not seem to have any way to rekey. However there
is PR #94 about adding update protocol that can be used to rekey
connections.


The other parts of renegotiation are:
- Changing server certificate (does not seem useful)
- Changing connection parameters (does not seem useful)
- Updating authentication (this was later regarded as dangerous).

(There is PR #95[2] about "watered down" version of authentication. However
I still view this as dangerous[1]).


[1] E.g. Try to use it with HTTP/2 mid-connection and watch the things
go wrong in possibly exploitable way... In multiplexed protocols,
certificate changes need to be coordinated at higher layers.

[2] Also, ugh, the PRs building on top of update (update-auth and
update-resume) are a bit difficult to read due to duplicating changes
later merged into editor's copy.


-Ilari