Key Re-Exchange

[Markus Friedl <markus.friedl%informatik.uni-erlangen.de@localhost>]

hi,

I have some questions regarding the 'Key Re-Exchange' (aka rekeying):

is it true that no application data may be sent during key re-exchange?

how is this 'during key re-exchange' defined?

i think that that the re-exchange starts when a KEXINIT message has
been both sent _and_ received.

so, if you initiate the re-exchange, you have to wait for the KEXINIT
from the peer, but since there might be some more packets one the
wire i might get these messages before i get the KEXINIT.

the problem here is that i cannot tell whether my KEXINIT message
did already arrive at the peer or whether the peer just ignores the
KEXINIT message and just keeps sending applications messages.

am i missing something?

what are other implementations doing?

i think that the paragraph about the re-exchange should to be extended
in the current transport-draft.

-markus