Shibboleth Developers

[Kaspar Brand <>]

On 09.02.2011 17:58, Cantor, Scott E. wrote:
>>> Don't focus on sessionid, in SSL3 and later. Work with the
>>> channel binding that cues off the finished messages (not the
>>> endpoint certs).
>> 
>> Even if we understood how that would work, Java doesn't expose
>> that message.
> 
> Actually, thinking about this, AFAIK, the server end of a bound TLS
> channel has to be relying on the session ID to know that it's the
> same client anyway. The Finished message is only there at the time
> the channel is bound, and subsequent traffic has to be recognized as
> coming from the same client for it to be useful. I don't think
> there's any other way to do that but the session ID across separate
> TCP connections.

RFC 5929 is somewhat pertinent here. I'm not sure if/what TLS
implementations already expose tls-unique to the app, though (cf. also
section 7 of said RFC).

Kaspar