Subject: Re: [TLS] Call for Consensus on removal of renegotiation

From: "[email-masked]" <[email-masked]>
Date: Wed, 2 Jul 2014 20:19:00 +0200

On 25 Jun 2014, at 22:47, Yoav Nir <[email-masked]> wrote:

> 
> On Jun 25, 2014, at 11:42 PM, Salz, Rich <[email-masked]> wrote:
> 
>>> Nothing. But that would require changing those applications.
>> 
>> Wouldn't they already have to change in order to use TLS 1.3?  Or would the underlying library switch to it, and then not do the magic rekey calls?
> 
> An application running on something like Apache can replace the OpenSSL library, and instantly get upgraded from supporting only SSLv3 and TLS 1.0 to support TLS 1.2 and AES-GCM and ECDHE.
> 
> If that application ever ran enough traffic that renegotiation for rekeying was needed, upgrading to the next OpenSSL that includes TLS 1.3 would not be as smooth.
> 
> BTW: This discussion is totally missing the other use of renegotiation - to move from server-authenticated to mutually-authenticated. Unless that need is addressed (by some mechanism), I can’t support removing renegotiation.

+1

I am surprised that even though this was seriously discussed in the previous threads, it was not
put forward as an option in the straw poll. Removing renegotiation MUST Be conditional on the ability
to write servers that allow the client to move from anonymous to TLS Certificate based authentication
when needed. And it has to be baked into TLS1.3 and not part of some optional spec.

Perhaps something like http://tools.ietf.org/html/draft-thomson-tls-care-00 will do. But one needs
to make sure that you don't make a protocol such as WebID+TLS go from implementable to non-implementable.
( see http://webid.info/ )

Henry

Social Web Architect
http://bblfish.net/