Date: Wed, 08 Apr 2020 07:12:10 -0700
From: ianswett <notifications@github.com>
Reply-To: quicwg/base-drafts
 <reply+AFTOJK5KQRVCTTOOK5J7GPV4TG6LVEVBNHHCHCO5YE@reply.github.com>
To: quicwg/base-drafts <base-drafts@noreply.github.com>
Cc: Subscribed <subscribed@noreply.github.com>
Message-ID: <quicwg/base-drafts/pull/3566/review/390012214@github.com>
In-Reply-To: <quicwg/base-drafts/pull/3566@github.com>
References: <quicwg/base-drafts/pull/3566@github.com>
Subject: Re: [quicwg/base-drafts] Text on session resumption (#3566)
Mime-Version: 1.0
Content-Type: multipart/alternative;
 boundary="--==_mimepart_5e8ddbba78dee_af23f940c6cd95c130836";
 charset=UTF-8
Content-Transfer-Encoding: 7bit
Precedence: list
Archived-At: <https://mailarchive.ietf.org/arch/msg/quic-issues/Y9jIx_RERrSEn5zmCJ9e6EZqOq4>


----==_mimepart_5e8ddbba78dee_af23f940c6cd95c130836
Content-Type: text/plain;
 charset=UTF-8
Content-Transfer-Encoding: 7bit

@ianswett approved this pull request.



> @@ -648,6 +648,31 @@ messages and clients MUST treat receipt of such messages as a connection error
 of type PROTOCOL_VIOLATION.
 
 
+## Session Resumption {#resumption}
+
+QUIC can use the session resumption feature of TLS 1.3. It does this by
+carrying NewSessionTicket messages in CRYPTO frames after the handshake is
+complete. Session resumption is the basis of 0-RTT, but can be used without
+also enabling 0-RTT.
+
+Endpoints that use sesion resumption might need to remember some information

```suggestion
Endpoints that use session resumption might need to remember some information
```

> +
+Endpoints that use sesion resumption might need to remember some information
+about the current connection when creating a resumed connection. TLS requires
+that some information be retained; see Section 4.6.1 of {{!TLS13}}. QUIC itself
+does not depend on any state being retained when resuming a connection, unless
+0-RTT is also used; see {{enable-0rtt}} and Section 7.3.1 of
+{{QUIC-TRANSPORT}}. Application protocols could depend on state that is
+retained between resumed connections.
+
+Clients can store any state required for resumption along with the session
+ticket. Servers can use the session ticket to help carry state.
+
+Session resumption allows servers to link activity on the original connection
+with the resumed connection, which might be a privacy issue for clients.
+Clients can choose not to enable resumption to avoid creating this correlation.
+Client SHOULD NOT reuse tickets as that allows entities other than the server

```suggestion
Client SHOULD NOT use a single ticket more than once as that allows entities other than the server
```

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3566#pullrequestreview-390012214
----==_mimepart_5e8ddbba78dee_af23f940c6cd95c130836
Content-Type: text/html;
 charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<p></p>=0D
<p><b>@ianswett</b> approved this pull request.</p>=0D
=0D
<hr>=0D
=0D
<p>In <a href=3D"https://github.com/quicwg/base-drafts/pull/3566#discussi=
on_r405554927">draft-ietf-quic-tls.md</a>:</p>=0D
<pre style=3D'color:#555'>&gt; @@ -648,6 +648,31 @@ messages and clients =
MUST treat receipt of such messages as a connection error=0D
 of type PROTOCOL_VIOLATION.=0D
 =0D
 =0D
+## Session Resumption {#resumption}=0D
+=0D
+QUIC can use the session resumption feature of TLS 1.3. It does this by=0D=

+carrying NewSessionTicket messages in CRYPTO frames after the handshake =
is=0D
+complete. Session resumption is the basis of 0-RTT, but can be used with=
out=0D
+also enabling 0-RTT.=0D
+=0D
+Endpoints that use sesion resumption might need to remember some informa=
tion=0D
</pre>=0D
=E2=AC=87=EF=B8=8F Suggested change=0D
<pre style=3D"color: #555">-Endpoints that use sesion resumption might ne=
ed to remember some information=0D
+Endpoints that use session resumption might need to remember some inform=
ation=0D
</pre>=0D
=0D
=0D
<hr>=0D
=0D
<p>In <a href=3D"https://github.com/quicwg/base-drafts/pull/3566#discussi=
on_r405555720">draft-ietf-quic-tls.md</a>:</p>=0D
<pre style=3D'color:#555'>&gt; +=0D
+Endpoints that use sesion resumption might need to remember some informa=
tion=0D
+about the current connection when creating a resumed connection. TLS req=
uires=0D
+that some information be retained; see Section 4.6.1 of {{!TLS13}}. QUIC=
 itself=0D
+does not depend on any state being retained when resuming a connection, =
unless=0D
+0-RTT is also used; see {{enable-0rtt}} and Section 7.3.1 of=0D
+{{QUIC-TRANSPORT}}. Application protocols could depend on state that is=0D=

+retained between resumed connections.=0D
+=0D
+Clients can store any state required for resumption along with the sessi=
on=0D
+ticket. Servers can use the session ticket to help carry state.=0D
+=0D
+Session resumption allows servers to link activity on the original conne=
ction=0D
+with the resumed connection, which might be a privacy issue for clients.=
=0D
+Clients can choose not to enable resumption to avoid creating this corre=
lation.=0D
+Client SHOULD NOT reuse tickets as that allows entities other than the s=
erver=0D
</pre>=0D
=E2=AC=87=EF=B8=8F Suggested change=0D
<pre style=3D"color: #555">-Client SHOULD NOT reuse tickets as that allow=
s entities other than the server=0D
+Client SHOULD NOT use a single ticket more than once as that allows enti=
ties other than the server=0D
</pre>=0D
=0D
=0D
<p style=3D"font-size:small;-webkit-text-size-adjust:none;color:#666;">&m=
dash;<br />You are receiving this because you are subscribed to this thre=
ad.<br />Reply to this email directly, <a href=3D"https://github.com/quic=
wg/base-drafts/pull/3566#pullrequestreview-390012214">view it on GitHub</=
a>, or <a href=3D"https://github.com/notifications/unsubscribe-auth/AFTOJ=
KZWW4JFGR3XG6D6QJ3RLSA3VANCNFSM4MDRGVZA">unsubscribe</a>.<img src=3D"http=
s://github.com/notifications/beacon/AFTOJKYX37W4A56QJFH64RDRLSA3VA5CNFSM4=
MDRGVZKYY3PNVWWK3TUL52HS4DFWFIHK3DMKJSXC5LFON2FEZLWNFSXPKTDN5WW2ZLOORPWSZ=
GOC47R2NQ.gif" height=3D"1" width=3D"1" alt=3D"" /></p>=0D
<script type=3D"application/ld+json">[=0D
{=0D
"@context": "http://schema.org",=0D
"@type": "EmailMessage",=0D
"potentialAction": {=0D
"@type": "ViewAction",=0D
"target": "https://github.com/quicwg/base-drafts/pull/3566#pullrequestrev=
iew-390012214",=0D
"url": "https://github.com/quicwg/base-drafts/pull/3566#pullrequestreview=
-390012214",=0D
"name": "View Pull Request"=0D
},=0D
"description": "View this Pull Request on GitHub",=0D
"publisher": {=0D
"@type": "Organization",=0D
"name": "GitHub",=0D
"url": "https://github.com"=0D
}=0D
}=0D
]</script>=

----==_mimepart_5e8ddbba78dee_af23f940c6cd95c130836--