Re: [TLS] TLS renegotiation issue

[Martin Rex <mrex at sap.com>]

Michael D'Errico wrote:
> 
> Martin Rex wrote:
> > 
> > Eric's proposal to make renegotiation secure does not need any
> > API-level changes, everything is completely internal to the
> > TLS protocol engine.
> 
> Having finished implementing the proposal, I can say that this is
> a true statement.  No API changes were required.

Nico has drawn a raw sketch about SSPI (Microsoft schannel),
and that API will probably require a minor change.
I have not personal experiences with schannel, but from what
Nico described, I think a single new API function and slight
modification of the context iteration functions might
be sufficient (as discussed earlier postings).

CreateRenegoSecurityContext(prev_context, options, &new_context);


-Martin