Shibboleth Developers

[Bradley Schwoerer <>]

FWIW, Apple iOS products and most other mobile devices create a new tls 
session after short periods of time when on non-wifi connections.  I have 
seen my iOS devices change ip addresses when there is 30seconds of network 
idle time on AT&T's 3G network.

Bradley

On Feb 9, 2011, at 10:58 AM, "Cantor, Scott E." 
<>
 wrote:

>>> Don't focus on sessionid, in SSL3 and later. Work with the channel binding
>>> that cues off the finished messages (not the endpoint certs).
>> 
>> Even if we understood how that would work, Java doesn't expose that
>> message.
> 
> Actually, thinking about this, AFAIK, the server end of a bound TLS channel 
> has to be relying on the session ID to know that it's the same client 
> anyway. The Finished message is only there at the time the channel is 
> bound, and subsequent traffic has to be recognized as coming from the same 
> client for it to be useful. I don't think there's any other way to do that 
> but the session ID across separate TCP connections.
> 
> -- Scott
>