Re: [TLS] RESOLVED (Re: [sasl] lasgt call comments (st Call:

[Martin Rex <Martin.Rex at sap.com>]

Peter Gutmann wrote:
> 
> Martin Rex <Martin.Rex at sap.com> writes:
> 
> >Microsoft's implementation (which could be the one referred to by
> >Larry's implementation) has a silly design flaw in its TLS renogiation,
> >and I'm not sure that the previous text is a way to fix it.
> >
> >It is possible to configure Microsoft IIS in a fashion so that it
> >will first perform a TLS handshake with a server-only authentication,
> >and after having received the HTTP request, it will re-negotiate and
> >ask for a client certificate.
> 
> It's not necessarily a design flaw, AFAIK it's a performance optimisation to 
> avoid the server having to maintain state/leave a connection open for an 
> arbitrary amount of time while the user fumbles around with smart cards and 
> certificates and whatnot.

I'm sorry if I have explained myself so badly.

I was NOT talking about the closing of the connection while the
client is prompting the user for selection of a client certificate.
That is actually an extremely appreciated feature of MSIE (the Browser),
a point where most other web browsers are broken in that they
stall the server in the middle of a TLS handshake for an indefinite
amount of time while performing user interaction.

I was refering to a design flaw in server-side session caching of
Microsoft IIS (the Server) when it is configured to perform renegotiation
in order to obtain a client certificate after having seen and evaluated
the request.

-Martin