Re: [kitten] last call: draft-ietf-kitten-tls-channel-bindings-for-tls13-02

[Sam Whited <[e-mail]>]

Thank you, I've moved this into a new "Use with Legacy TLS" section
under the security considerations. I think that "must" should remain
lower case since it's on something a bit hand-wavy and doesn't mention
any real behavior or changes to make.

I'll wait a bit longer for more feedback then push an update with what
I've got so far. Thanks again!

—Sam

On Fri, Mar 12, 2021, at 09:56, Dave Cridland wrote:
> Hi Sam, Kittens,
>
> Summary: Yeah, ready, I think, but a tiny bit of wordsmithing might
> benefit.
>
> Main Issue:
>
> Use with TLS 1.2 is not entirely clear. I think all the information is
> there, but it's a little scattered, and I misread the "When TLS
> renegotiation is enabled (pre TLS 1.3)" initially. While TLS 1.3 is
> obviously desirable, there's enough TLS 1.2 out there that making this
> clear would be a benefit.
>
> So I would personally extract the last paragraph of §2 and the first
> from §3 into a new section (§2.1, §3.1, or something else). A
> suggestion of actual text for this new version (mostly a cut and
> paste). I'm not sure if the "must" wants to be a MUST here, either:
>
> Use with earlier TLS versions
>
>    While it is possible to use this channel binding mechanism with TLS
>    versions below 1.3, extra precaution must be taken to ensure that
>    the chosen cipher suites always result in unique master secrets.
>    For more information see the Security Considerations section of
>    [RFC5705].
>
>    In addition, session renegotiation MUST NOT be enabled. When TLS
>    renegotiation is enabled the "tls-exporter" channel binding type is
>    not defined and implementations MUST NOT support it.
>
> If you use this suggestion, you may wish to include a "Other security
> considerations are discussed throughout this document" in Security
> Considerations, and you may wish to do that anyway.
>
> You may also want to drive home the point that people really ought to
> just use 1.3.
>
> Many thanks for writing this document and riding it through, I fully
> intend to implement as and when the APIs surface.