-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 FYI from the TLS list... - -------- Original Message -------- Subject: Re: [TLS] draft-rescorla-tls-renegotiate and MITM resistance Date: Wed, 11 Nov 2009 06:09:08 +0900 From: Peter Saint-Andre <stpeter at stpeter.im> To: Nicolas Williams <Nicolas.Williams at sun.com> CC: tls at ietf.org References: <006FEB08D9C6444AB014105C9AEB133FB36A4EBF03 at il-ex01.ad.checkpoint.com> <200911092152.nA9LqVkW000963 at fs4113.wdf.sap.corp> <20091109223417.GK1105 at Sun.COM> <4AF8E755.5020208 at extendedsubset.com> <20091110164609.GS1105 at Sun.COM> <4AF9AA9E.8030603 at extendedsubset.com> <20091110181544.GW1105 at Sun.COM> On 11/11/09 3:15 AM, Nicolas Williams wrote: > On Tue, Nov 10, 2009 at 12:02:06PM -0600, Marsh Ray wrote: >> Nicolas Williams wrote: >>> On Mon, Nov 09, 2009 at 10:08:53PM -0600, Marsh Ray wrote: >>> >>> TLS connections are not so long lived >> But there is no defined upper limit. > > True, and indeed, IMAP depends on that. Are there IMAP/other servers > the request re-negotiation when a client's cert reaches/nears > expiration? > > If so then my assertion that we don't have to worry about key rollover/ > cert expiration would be wrong. Indeed, it's safer to assume that that > assertion was wrong as finding out for sure would be hard. > > However, this is a constraint that _applications_ could enforce, or > request be enforced by the TLS implementation (oh dear, back to APIs). IMHO this is the responsibility of the application. For example in XMPP we use long-lived TCP connections and, on top of those, long-lived XML streams that can be TLS-protected. In practice, for server-to-server federation (and even for client-to-server communication) those connections might be up for days, weeks, even months. At this point the handling of long-lived XML streams is unspecified, but I would expect most XMPP servers to terminate the connection and force the other party to reconnect. I'll bring this up on the XMPP WG list... Peter _______________________________________________ TLS mailing list TLS at ietf.org https://www.ietf.org/mailman/listinfo/tls -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.8 (Darwin) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iEYEARECAAYFAkr51pcACgkQNL8k5A2w/vwVXwCdEMCH1UdYXcJy5qlC+0i/A91c 7oAAn1FIW22I240HvRxGOjHI6nvjmicw =pCXp -----END PGP SIGNATURE-----
Note Well: Messages sent to this mailing list are the opinions of the senders and do not imply endorsement by the IETF.