Re: [TLS] Call for Consensus on removal of renegotiation

On Fri, Jun 27, 2014 at 10:09 PM, Martin Rex <mrex@sap.com> wrote:
> Peter Gutmann wrote:
>> James Cloos <cloos@jhcloos.com> writes:
>>>
>>>If tls1.3 drops rekeying established sockets, then one reasonably can predict
>>>that its adoption will be limited enough that any security benefits it has
>>>over 1.2 will be, mostly, for naught.
>
> I think that TLSv1.3 will be largely ignored for many other reasons
> (except maybe by a few (heart)bleeding edge implementations that spend
>  their scarce resources to implement every TLS kitchen sink rather than
>  for quality of the stuff that is important).

Hard to say: removing one round trip doesn't need to be especially
complicated: False Start demonstrated that.

For the web this latency really matters, so browsers are very
motivated to support TLS 1.3

Of course, only four implementations matter: one for the server, the
one in Chrome,
the one in Mozilla, and the one in Microsoft Windows.

>
>
>>
>> That's pretty speculative.  My speculation is instead:
>>
>>   If tls1.3 drops rekeying established sockets, then one reasonably can
>>   predict that people won't rekey established sockets any more.
>>
>> I'd say that's far more likely.
>
> For the purpose of rekeying, I still think that renegotiation is
> a pretty good solution.

Only if we tolerate the delays it introduces, and mandate significant
restrictions on what can change.
Interestingly some browsers seem to have already done this to fix
Triple Handshake.

>
>
> Bottom line:  if renegotiation is dropped from TLSv1.3, then long-lived
> connections with either not rekey, i.e. kiss forward secrecy good-bye,
> or long-lived connections will kiss TLSv1.3 good-bye.
>
> The latter of these two options is less work and immediately available...

Why are these the two options? TLS 1.3 could provide a transparent
rekeying option, that unlike renegotiation
doesn't require excessive round trips.

Sincerely,
Watson Ladd

>
>
>
> -Martin
>
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls

-- 
"Those who would give up Essential Liberty to purchase a little
Temporary Safety deserve neither  Liberty nor Safety."
-- Benjamin Franklin