Re: [TLS] Doing without renegotiation

[Nico Williams <[e-mail]>]

On Thu, Apr 17, 2014 at 12:43 AM, Henrick Hellström
<[e-mail]> wrote:
> On 2014-04-17 05:50, Nico Williams wrote:
>>   - For rekeying just introduce a CCS-like record whose purpose is to
>>     indicate that the sender is changing to new keys on the send side.
>>     The new keys are derived from the same master secret as the preceding
>>     keys, in the same way, but with a counter appended to the "key
>>     expansion" salt.
>>
>>     There's no need to synchronize, but DTLS requires retransmission of
>>     such messages else when dropped the recipient will not be able to
>>     decrypt any subsequent messages.
>
>
> This might be an option if the purpose of the renegotiation is just to
> reduce the risk of state collisions in the bulk encryption cipher, but it is

Yes, much like SSHv2 recommends rekeying after 2^L/4 packets, where L
is the cipher's block length (sadly no reference is given for this).

> no replacement for renegotiation of DHE/ECDHE sessions in order to refresh
> the perfect forward secrecy.

This could be done with a single round trip, no need for a full
handshake.  The payloads containing the ephemeral keys for rekeying
could be sent opportunistically when the application writes.

Nico
--