Re: [TLS] COMMENT: draft-ietf-tls-renegotiation

[Peter Saint-Andre <[e-mail]>]

On 12/15/09 9:31 AM, Marsh Ray wrote:
> Ran Canetti wrote:
>> Indeed.
>>
>> Or, at least, a strong case should be made why renegotiation (within the
>> same session, from the point of view of the application) is an important
>> feature to preserve.
> 
> A large number of systems are currently using it. We don't know exactly,
> but this might give you an idea:
> 
> http://www.google.com/search?q=microsoft+iis+client+certificate
> 
> Do they really need it? Probably some do, some don't. Some installations
> could rearrange their sites to not need it, and some have more IIS web
> servers than they could begin to count.
> 
> Why should we keep renegotiation?
> 
> Because any spec which "drops" it is just going to be ignored, with the
> side effect of the industry dropping the IETF rather than the IETF
> dropping renegotiation.

Given that the TLS WG list is full of discussion about remaining
backward-compatible with SSLv3, it's not clear if the industry is paying
attention to the IETF anyway.

> Removing support for (i.e., not fixing) a fundamental and widely-used
> protocol feature like renegotiation is not an option.

I think the question Russ raised is: just how fundamental is TLS
renegotiation? And the answer so far seems to be: some deployments seem
to use it, but it might not be fundamental.

Peter

-- 
Peter Saint-Andre
https://stpeter.im/