Re: [quicwg/base-drafts] clarify the scope of a NEW_TOKEN token (#3156)

[Kazuho Oku <[e-mail]>]

@ekr Quoting from [RFC 8446 section 4.6.1](https://tools.ietf.org/html/rfc8446#section-4.6.1), the requirement for NST is:
```
   Clients MUST only resume if the new SNI value is valid for the server
   certificate presented in the original session and SHOULD only resume
   if the SNI value matches the one used in the original session.
```

MUST NOT of added in this PR achieves parity with the "MUST only" statement in TLS 1.3.

Regarding the SHOULD in TLS 1.3, I do not think we need feature parity. Compared to TLS 1.3 running over TCP, it is extremely difficult in QUIC to create a proxy that extracts the SNI and then let's different backend server handle the connection. It is natural to assume that a QUIC server that presents a wildcard certificate to be directly hosting all those server identities.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3156#issuecomment-554279982