Re: [TLS] Proposal for hybrid solution using most of the ideas

[Martin Rex <mrex at sap.com>]

Nasko Oskov wrote:
> 
> Michael D'Errico wrote:
> >
> > Also the Certificate message is optional, so it would cause
> > trouble for some cipher suites.
> 
> Fair point.
> 
>
> > And even more importantly, there is only ServerHello sent
> > when you resume an old session!
> 
> Session resumption is already secure since it uses existing crypto state
> as part of the negotiation. There are no problems in that case.

I'm confused by the latter.  It doesn't sound right.

A resumed TLS session can certainly be reneogitated later, and
of course, we neither a TLS session resume to be proxied into
the reneogitation of a server, nor do we want a TLS renegotiation
on a resumes session to be unprotected/insecure like in the past.


Althouh TLS session resume seems to have been disabled during renegotiation
by at last some implementations, it would actually the first choice
if all that the client wants to do is rekeying (huge data transfers
an only RC4 or 3DES ciphersuites), because it would be the most
efficient.

TLS session resume avoids the PKI crypto overhead of the full handshake,
_but_ will derive new session keys from the master secret of the cached
session plus ClientHello.Random and ServerHello.Random
and reinitialize the SecurityParameters of the connection state.


A client initiating a TLS renegotiation would know whether it wants
to rekey (and would significantly benefit from a TLS session resume)
or when it wants to change the cryptographic characteristics of
the TLS session.

When the Client receives a ClientHelloRequest from the server,
then it doesn't know what the Server is trying to achieve by that.
The most common usage scenario for TLS renegotiation seems to
be delayed or on-demand authentication, and there a TLS session
resume wouldn't help.  But then, the server gets actually to
choose whether it performs a full TLS handshake or whether 
it agrees to a TLS session resume proposed by the client.


From a technical point of view, a client proposing TLS resume on a
client-initiated TLS renegotiation is the same as disconnecting,
reconnecting and proposing TLS resume on the new connection.


-Martin