Re: [TLS] TLS or HTTP issue?

[Nicolas Williams <Nicolas.Williams at sun.com>]

On Fri, Nov 06, 2009 at 06:13:44PM +0100, Martin Rex wrote:
> From the original design, and in the two quoted paragraphs above,
> it appears that SSL and its successor TLS was intended to be
> _very_ transparent, and the spec contains guidance for
> security-relevant signaling to the application only for
> the initial TLS handshake on a connection (full initial handshake,
> and session resume), but _NOT_ for the session renegotiation.
> 
> Therefore, I think, we do have a real shortcoming of the
> SSL/TLS protocol, and we really should scramble to fix it.
> 
> That includes improving on the guidance for the signaling
> and semantics of a TLS session renegotiate of the TLS
> protocol stack to the application -- in a fashion so that
> it can be folded back into rfc5246bis.

"Signaling" --- sounds like an... API!

Nico
--