Re: [TLS] draft-rescorla-tls-renegotiate and MITM resistance

[Marsh Ray <marsh at extendedsubset.com>]

Nicolas Williams wrote:
> On Mon, Nov 09, 2009 at 10:52:31PM +0100, Martin Rex wrote:
>> I whish there was a constraint that an identity/certificate that has
>> been established for a party during the TLS handshake MUST not change
>> during re-negotiation,

Hmm, few questions about that plan:

Is this currently a defined concept in TLS: equivalence of identity?

Isn't that one of the major uses of renegotiation? To change identity?
That seems to be the entire point of the observed cases of renegotiation
in https. Even if the only case we know of is a transition from an
anonymous identity to a client-certified one, such a new constraint
seems a bit pointless and likely to break someone.

Perhaps you want to allow identities to be "strengthened" but not
"weakened". Is this another new concept in TLS: are identities required
to be partially- or fully-ordered?

It's starting to sound like that question about ciphersuites being
ordered according to strength.

Would that make it illegal to resume a previous session over the same
underlying connection if it could not be proven it was "the same" identity?

What if the session's identity were strengthened? Could you end up in a
situation where a session could be resumed on any of several other
connections except the one on which it originated!

- Marsh