Re: [quicwg/base-drafts] Prohibit TLS 1.3 middlebox compatibility mode (#3595)

[Kazuho Oku <[e-mail]>]

@kazuho commented on this pull request.



> @@ -1631,6 +1632,21 @@ PROTOCOL_VIOLATION.
 As a result, EndOfEarlyData does not appear in the TLS handshake transcript.
 
 
+## Prohibit TLS Middlebox Compatibility Mode {#compat-mode}
+
+Appendix D.4 of {{!TLS13}} describes an alteration to the TLS 1.3 handshake as
+a workaround for bugs in some middleboxes. The TLS 1.3 middlebox compatibility
+mode involves setting the legacy_session_id field to a 32-byte value in the
+ClientHello and ServerHello, then sending a change_cipher_spec record. Both
+field and record carry no semantic content and are ignored.
+
+This mode has no use in QUIC as it only applies to middleboxes that interfere
+with TLS over TCP. A client MUST NOT request the use of the TLS 1.3
+compatibility mode. A server MUST treat the receipt of a TLS ClientHello that
+requests the use of the TLS 1.3 middlebox compatibility mode as a connection
+error of type PROTOCOL_VIOLATION.

Use of MUST NOT for client is fine, but I would prefer using SHOULD or MAY on the server-side.

In a server-side TLS 1.3 stack, it is entirely reasonable to implement Compatibility Mode at the record layer in a reactive manner. In your record layer, when you receive the handshake traffic secret from the handshake layer, you inject CCS depending on the length of SH.legacy_session_id that has been retained.

Use of MUST NOT for the server breaks TLS stacks implemented that way.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3595#pullrequestreview-398746203