Re: [TLS] matching identity, by default

[Marsh Ray <[e-mail]>]

Bodo Moeller wrote:
> TLS has never meant to allow a new
> client or server application entity to enter the conversation when a
> renegotiation handshake takes place

I disagree. The person(s) who added renegotiation clearly wanted to
enable multiple "application entities" to run on the same port 443.
These may be communicated over the same pool of active socket
connections, as Nelson Bolyard of NSS (hier of the Netscape legacy
implementation, twice removed) has described.

Whether or not that was a wise design, or whether it was implemented
perfectly is certainly debatable. We can all agree that certain
implications of this design were under-documented.

> Here's a new proposal:
> 
> "[..] TLS implementations MUST NOT use a change of Certificate
> information to indicate that subsequent application data will be in the
> responsibility of a different client or server application entity.

I don't support such wording. If someone wants to write a TLS
application layer protocol that way, there's no good reason for the spec
to prohibit it at this stage in the game.

> That
> is, if a new or changed Certificate message appears in a renegotiation
> handshake and is successfully verified, it is understood that this is a
> change in identification information only and not a change in identity."

It might not even be a swap-out change, it could be additive or have
other app-defined semantics. For example, a client or server application
could renegotiate ten times and provide ten different certificates, then
renegotiate to ephemeral Diffie-Hellman. The application protocol may be
defined to treat subsequent data as being authenticated to any or all of
the ten certificated identities.

Another point is that TLS doesn't have to run over TCP. Imagine you need
a way to securely convey authenticated data over a bare synchronous or
asynchronous link (e.g. RS-232). TLS would be a natural choice, but if
you restrict arbitrary certificate changes, you won't be able to use it
continuously. You'll have to drop out of TLS altogether and start a new
handshake, thus introducing unnecessary encryption and authentication gaps.

- Marsh