Subject: [TLS] RFC 5705 and reconnection

From: "Jim Schaad" <[email-masked]>
Date: Thu, 23 Feb 2012 17:55:12 -0800

I was planning on using RFC 5705 for getting some cryptographic material
relating to the TLS channel, however I was asked a question about
reconnections and it suddenly dawned on me that I don't know what the
behavior would be in the event of a reconnect/resumption occurring.

If I get the key material immediately, then I will be able to have the
material agree.

If there is an amount of time between when the client and the server look to
derive the key material, and if a re-connect occurs during that interval,
then will they client and the server have the same material?  

Jim

---

From: Eric Rescorla <[email-masked]>
Date: Fri, 24 Feb 2012 07:52:16 -0800

I'm not sure I understand the context. Is this about rehandshake on the same
channel or about resumption on a different channel?

-Ekr

---

From: "Jim Schaad" <[email-masked]>
Date: Fri, 24 Feb 2012 08:21:03 -0800

Possibly both, it would depend on what the client and server applications
are expected to know.  I was originally thinking about resumption on a
different channel.

Jim

> -----Original Message-----
> From: Eric Rescorla [mailto:[email-masked]]
> Sent: Friday, February 24, 2012 7:52 AM
> To: Jim Schaad
> Cc: [email-masked]
> Subject: Re: RFC 5705 and reconnection
> 
> I'm not sure I understand the context. Is this about rehandshake on the
> same channel or about resumption on a different channel?
> 
> -Ekr
> 
> 
> > I was planning on using RFC 5705 for getting some cryptographic
> > material relating to the TLS channel, however I was asked a question
> > about reconnections and it suddenly dawned on me that I don't know
> > what the behavior would be in the event of a reconnect/resumption
> occurring.
> >
> > If there is an amount of time between when the client and the server
> > look to derive the key material, and if a re-connect occurs during
> > that interval, then will they client and the server have the same
material?

---

From: Eric Rescorla <[email-masked]>
Date: Fri, 24 Feb 2012 08:27:51 -0800

> are expected to know.  I was originally thinking about resumption on a

As Nasko says, the exporters on different channels (even with resumption)
are (deliberately) different. So, applications which want to have a secret
spanning channels will need to figure something else out, I suspect

-Ekr