Re: [TLS] TLS renegotiation issue

[Nicolas Williams <Nicolas.Williams at sun.com>]

On Thu, Nov 05, 2009 at 05:03:44PM -0600, Nicolas Williams wrote:
> On Thu, Nov 05, 2009 at 10:16:11AM -0800, Eric Rescorla wrote:
> > I now have a draft extension up at:
> > 
> > https://svn.resiprocate.org/rep/ietf-drafts/ekr/draft-rescorla-tls-renegotiate.txt
> > https://svn.resiprocate.org/rep/ietf-drafts/ekr/draft-rescorla-tls-renegotiate.xml
> > 
> > Comments welcome.
> 
> More comments:
> 
>  - Consider an implementation like Windows' SSPI-based implementation.
>    Or, for that matter, the old GGF (Global Grid Forum) GSS-API
>    interface to TLS.

I've thought about this some more.  I think now that what I considered a
layering violation earlier today actually isn't.  A security mechanism
that takes an input channel binding, removes the channel binding type
prefix then splits the remainder into two octet strings, with each
end-point sending one half, is actually conformant to RFC5056.

Therefore I have no further objections, and, for now, no further
comments.

Nico
--