Subject: [TLS] Substitute for renegotiation in TLS 1.3

From: Albe Laurenz <[email-masked]>
Date: Mon, 23 Feb 2015 10:46:29 +0000

While researching a renegotiation problem I saw that TLS 1.3 has done away
with this feature altogether.

During the discussion that led to this
(http://www.ietf.org/mail-archive/web/tls/current/msg12906.html)
most people seemed to favor a new "rekey" facility as a substitute,
and this consensus is expressed in
http://www.ietf.org/mail-archive/web/tls/current/msg13176.html

In a first take, this was accomplished by repurposing ChangeCipherSpec
to create a new master secret:
http://www.ietf.org/mail-archive/web/tls/current/msg12609.html

However, in a later commit
(https://github.com/tlswg/tls13-spec/commit/21099bc7ff338d8deae6c3ae832f03dff29840c2)
ChangeCipherSpec was removed, and I can neither find the discussion leading
to that nor any mention in the commit how "rekey" should be accomplished now.

Does that mean that there is no possibility to renegotiate any more?
That would be unfortunate for my use case (encrypted database connections which
can last arbitrarily long).
Moreover, it would go against the consensus on the list, as quote above.

Yours,
Laurenz Albe

---

From: Ilari Liusvaara <[email-masked]>
Date: Mon, 23 Feb 2015 13:45:11 +0200

> Moreover, it would go against the consensus on the list, as quote above.

Current editor's copy does not seem to have any way to rekey. However there
is PR #94 about adding update protocol that can be used to rekey
connections.

The other parts of renegotiation are:
- Changing server certificate (does not seem useful)
- Changing connection parameters (does not seem useful)
- Updating authentication (this was later regarded as dangerous).

(There is PR #95[2] about "watered down" version of authentication. However
I still view this as dangerous[1]).

[1] E.g. Try to use it with HTTP/2 mid-connection and watch the things
go wrong in possibly exploitable way... In multiplexed protocols,
certificate changes need to be coordinated at higher layers.

[2] Also, ugh, the PRs building on top of update (update-auth and
update-resume) are a bit difficult to read due to duplicating changes
later merged into editor's copy.

-Ilari

---

From: Albe Laurenz <[email-masked]>
Date: Mon, 23 Feb 2015 12:39:40 +0000

> is PR #94 about adding update protocol that can be used to rekey

Thanks for the answer.
So this is still work in progress, and I shouldn't worry that this
capability will be lost in TLS 1.3.

Yours,
Laurenz Albe