Date: Thu, 12 Sep 2019 22:19:04 -0700
From: Kazuho Oku <notifications@github.com>
Reply-To: quicwg/base-drafts
 <reply+AFTOJK4AOYHIBB2KJKLZBVF3RBMUREVBNHHB2ZES4M@reply.github.com>
To: quicwg/base-drafts <base-drafts@noreply.github.com>
Cc: Subscribed <subscribed@noreply.github.com>
Message-ID: <quicwg/base-drafts/issues/3028/531101603@github.com>
In-Reply-To: <quicwg/base-drafts/issues/3028@github.com>
References: <quicwg/base-drafts/issues/3028@github.com>
Subject: Re: [quicwg/base-drafts] Requiring per application data in session
 ticket seems wrong (#3028)
Mime-Version: 1.0
Content-Type: multipart/alternative;
 boundary="--==_mimepart_5d7b26c8dc39c_3e763f909a6cd9681410b2";
 charset=UTF-8
Content-Transfer-Encoding: 7bit
Precedence: list
Archived-At: <https://mailarchive.ietf.org/arch/msg/quic-issues/jFkS0t_TXC5YNpFAX7bmjmJKmBM>


----==_mimepart_5d7b26c8dc39c_3e763f909a6cd9681410b2
Content-Type: text/plain;
 charset=UTF-8
Content-Transfer-Encoding: 7bit

IIUC, while it is possible to use a session ticket when the SNI is the same, you can only use early data when ALPN also matches. Quoting from RFC 8446 section 4.2.10:

```
   In order to accept early data, the server MUST have accepted a PSK
   cipher suite and selected the first key offered in the client's
   "pre_shared_key" extension.  In addition, it MUST verify that the
   following values are the same as those associated with the
   selected PSK:

   -  The TLS version number
   -  The selected cipher suite
   -  The selected ALPN [RFC7301] protocol, if any
```

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/3028#issuecomment-531101603
----==_mimepart_5d7b26c8dc39c_3e763f909a6cd9681410b2
Content-Type: text/html;
 charset=UTF-8
Content-Transfer-Encoding: 7bit

<p>IIUC, while it is possible to use a session ticket when the SNI is the same, you can only use early data when ALPN also matches. Quoting from RFC 8446 section 4.2.10:</p>
<pre><code>   In order to accept early data, the server MUST have accepted a PSK
   cipher suite and selected the first key offered in the client's
   "pre_shared_key" extension.  In addition, it MUST verify that the
   following values are the same as those associated with the
   selected PSK:

   -  The TLS version number
   -  The selected cipher suite
   -  The selected ALPN [RFC7301] protocol, if any
</code></pre>

<p style="font-size:small;-webkit-text-size-adjust:none;color:#666;">&mdash;<br />You are receiving this because you are subscribed to this thread.<br />Reply to this email directly, <a href="https://github.com/quicwg/base-drafts/issues/3028?email_source=notifications&amp;email_token=AFTOJK6FCIF2EXHKLT33RT3QJMPERA5CNFSM4IWL5CVKYY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOD6T7PIY#issuecomment-531101603">view it on GitHub</a>, or <a href="https://github.com/notifications/unsubscribe-auth/AFTOJK2XAFBKDZGX3VNBMGTQJMPERANCNFSM4IWL5CVA">mute the thread</a>.<img src="https://github.com/notifications/beacon/AFTOJKYC5VZYYP4MM3MPESLQJMPERA5CNFSM4IWL5CVKYY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOD6T7PIY.gif" height="1" width="1" alt="" /></p>
<script type="application/ld+json">[
{
"@context": "http://schema.org",
"@type": "EmailMessage",
"potentialAction": {
"@type": "ViewAction",
"target": "https://github.com/quicwg/base-drafts/issues/3028?email_source=notifications\u0026email_token=AFTOJK6FCIF2EXHKLT33RT3QJMPERA5CNFSM4IWL5CVKYY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOD6T7PIY#issuecomment-531101603",
"url": "https://github.com/quicwg/base-drafts/issues/3028?email_source=notifications\u0026email_token=AFTOJK6FCIF2EXHKLT33RT3QJMPERA5CNFSM4IWL5CVKYY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOD6T7PIY#issuecomment-531101603",
"name": "View Issue"
},
"description": "View this Issue on GitHub",
"publisher": {
"@type": "Organization",
"name": "GitHub",
"url": "https://github.com"
}
}
]</script>
----==_mimepart_5d7b26c8dc39c_3e763f909a6cd9681410b2--