Subject: Re: [TLS] sessions, contexts, etc.

From: Ravi Ganesan <[email-masked]>
Date: Wed, 30 Dec 2009 16:46:49 -0800

Does something along these lines work as a pedagogical device? Nodes
characterized by the parameters of relevance. A root node, three types of
ways to spawn a child node. What a child inherits from parent, etc...

At the end of a TLS handshake, the Client and the Server share six key
pieces of information:
(i) a session-id  /*Public information */
(ii) a shared master-secret /*Secret. Known only to Client and Server */
(iii) the client-random and /* May be public or secret */
(iv) the server-random.  /*May be public or secret*/
(v) authentication knowledge /* Namely, the Client MAY know that is has
authenticated the Server (in practice this almost always is true). The
Server MAY know that it has authenticated the Client (relatively rare in
practice, but an important sub-category).
(vi) renegotiation-information /*The newly introduced RI field at the end of
the handshake. */

When the  Client and a Server share NONE of the above six pieces of data,
the Client will typically initiate a completely fresh session using the FULL
handshake.  Such a session is called a ROOT session. A Client and a Server
who have completed a ROOT session can engage in further handshakes to create
new sessions, which in turn can create further sessions. Treating each
session as a node in a graph we can get a tree rooted at the ROOT.

Each node can spawn a child node using three different techniques as
follows:

i) A node can create a child-node by performing an abbreviated handshake.
Such an abbreviated-child inherits the session-id, the shared master-secret
and the authentication-knowledge, from its parent (these CANNOT change). It
gets new client-random, server-random and starts afresh with
renegotiation-information.  This technique of spawning a child node is
usually used for efficiency considerations (abbrv. handshake requires no PKI
operations, which is why it cannot be used to update
authentication-knowledge of the other end either).  The creation of such a
child-node does NOT result in the previous node becoming inactive.

ii) A node can create a child node by performing renegotiation, followed by
a full handshake. Such a full-renego-child, starts afresh with new values
for all of the first five parameters. The only parameter which keeps it tied
to this tree is the renegotiation-information, which is derived from the
handshake and the parent-node's renegotiation-information. The primary
use-case for this technique is  to update authentication-knowledge of the
Server (i.e. does it know who the Client is?).  The creation of such a child
node means the parent node can no longer be used.

iii) A node can create a child node by performing renegotiation followed by
an abbreviated handshake. Such a abbrv-renego-child inherits the session-id,
shared-master-secret and authentication-information of its parent. There is
a new client-random and server-random, and as in a full-renego-child, the
renegotiation-information is derived from the handshake and the the
renegotiation-information of its parent.  I do not know why this use-case
exists; the encryption/hashing keys change but it is questionable if that
adds any protection. The creation of such a child node means the parent node
can no longer be used.

Observe that each of the different child nodes can give birth to any of the
other three types of children.

---

From: David-Sarah Hopwood <[email-masked]>
Date: Thu, 31 Dec 2009 02:16:22 +0000

> node means the parent node can no longer be used.

That (the last sentence) is not the case, as far as I'm aware. Renegotiating
on some connection currently associated with a session does not mean that
that session can no longer be resumed.

> adds any protection. The creation of such a child node means the parent node

Ditto.

-- 
David-Sarah Hopwood  ⚥  http://davidsarah.livejournal.com

---

From: "tom.petch" <[email-masked]>
Date: Thu, 31 Dec 2009 13:36:07 +0100

---- Original Message -----
From: "Ravi Ganesan" <[email-masked]>
Sent: Thursday, December 31, 2009 1:46 AM

> session as a node in a graph we can get a tree rooted at the ROOT.

I fear that this muddies the waters.  You seem to be using session for
what Nelson would call - pro tem - 'that TLS session/connection instance
thing'.  I think this wrong as session already has a separate semantic.

> a full handshake. Such a full-renego-child, starts afresh with new values

Again, I think this muddies the waters.  Renegotiation is not defined, but
the text in RFC5246 makes it clear to me that it starts with HelloRequest
or ClientHello and what is this last if not a handshake?  Abolish the word
renegotiation from this lexicon:-)  When we have the right terminology for
'that TLS session/connection instance thing', then we will be able to
characterise types of handshakes better and should have no need for it.

Tom Petch

> other three types of children.

--------------------------------------------------------------------------------

> _______________________________________________
> TLS mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/tls
>