Re: [Atlas] Status Update

[Hannes Tschofenig <[e-mail]>]

Hi Mirja,

~snip~

> Where the nice separation falls apart a bit (which is not appropriately reflected in the figures) is the unfortunate fact that the handshake protocol itself may need to use some security protection for its own use. In TLS the design just happens in such a way that the record layer is re-used for protecting handshake messages itself (once keys become available). In other protocols, like IKEv2/IPsec there are two separate mechanisms used.

It’s not only the protection but also other transport features, such as reliability. DTLS has its own little transport in that sense. The other option can you use one transport for the handshake and another to actually uses the encryption… from my understanding there are still two problems where things are not as separable as it would nice to have: a) the handshake itself uses the TLS record layer (which is not necessarily a problem but also is not necessary), and b) it’s not only the handshake but also later control messages that would need to be separated (eventually).

[Hannes] In DTLS the handshake contains reliability and fragmentation support. Is this necessary? Per definition of where DTLS is supposed to be used, it is necessary. If you don't need it then you also better use TLS instead.

So, in essence with the work in ATLAS we have been thinking about running TLS/DTLS on higher layers and also about separating the handshake from the application data protection. Going back to your initial question: Is there so much standardization that needs to be done? Based on our implementation experience with Mbed TLS and OpenSSL (by Owen, Mark and myself) the answer is clearly "no, there is not that much". Is there nothing to be done? I still think that there is a small amount of standardization work in addition to the description of the actual idea.

Ciao
Hannes
IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.