This question already has an answer here:
At the moment, I am trying to understand TLS in depth, thus reading RFC 5264. In section 6.1 the Connection State of the TLS Record Protocol is explained:
A TLS connection state is the operating environment of the TLS Record Protocol. It specifies a compression algorithm, an encryption algorithm, and a MAC algorithm. In addition, the parameters for these algorithms are known: the MAC key and the bulk encryption keys for the connection in both the read and the write directions. Logically, there are always four connection states outstanding: the current read and write states, and the pending read and write states. All records are processed under the current read and write states. The security parameters for the pending states can be set by the TLS Handshake Protocol, and the ChangeCipherSpec can selectively make either of the pending states current, in which case the appropriate current state is disposed of and replaced with the anstehend state; the pending state is then reinitialized to an empty state. It is illegal to make a state that has not been initialized with security parameters a current state. The initial current state always specifies that no encryption, compression, or MAC will be used.
What I take from this excerpt is that the TLS Record Protocol requires certain parameters (encryption keys, MAC algorithms, etc. ) to be set in order to work in a secure manner. The TLS Handshake Protocol provides most relevant parameters. At the very begining of the TLS Handshake, the security parameters aren't set ("no encryption, compression, or MAC").
But I don't get this part:
Logically, there are always four connection states outstanding: the current read and write states, and the pending read and write states. All records are processed under the current read and write states.
What do they mean by read state, write state and pending state?