[TLS] draft-ietf-tls-session-hash-04 and session resumption

[David Benjamin <[e-mail]>]

Sorry this is rather late feedback. I was looking at the new session
resumption provisions in draft-ietf-tls-session-hash-04, and one seems
problematic.

So, the draft has some SHOULDs which disable all EMS-less session
resumption:

> The client SHOULD NOT offer an abbreviated handshake to resume a session
that does not use an extended master secret.

> If the new ClientHello does not contain the "extended_master_secret"
extension, the server SHOULD fall back to a full handshake by sending a
ServerHello that rejects the offered session but continues with a full
handshake.

> If the new ServerHello does not contain the "extended_master_secret"
extension, the client SHOULD abort the handshake.

I suspect most implementations will ignore them for the time being.
Assuming they're ignored, being only SHOULDs,

> If the original session did not use an extended master secret but the new
ClientHello does contain the "extended_master_secret" extension, the server
MUST abort the handshake.

Consider a client which persists sessions to disk and then upgrades with
EMS support. Alternatively, the server may have since upgraded while
retaining the session cache. This can cause a client to offer an EMS-less
session to an EMS-ful server. This MUST now causes the server to abort the
handshake, which is rather unfriendly. Instead, I propose it change to:

> If the original session did not use an extended master secret but the new
ClientHello does contain the "extended_master_secret" extension, the server
MUST reject the session and fall back to a full handshake.

The new session will still be EMS-ful and we don't risk hard-to-diagnose
failures.

David