Re: [quicwg/base-drafts] Text on session resumption (#3566)

[Christian Huitema <[e-mail]>]

@huitema commented on this pull request.

As I said in the text comment, this is good. Only open question is whether there should be a "privacy consideration" note in the security section.

> +that some information be retained; see Section 4.6.1 of {{!TLS13}}. QUIC itself
+does not depend on any state being retained when resuming a connection, unless
+0-RTT is also used; see {{enable-0rtt}} and Section 7.3.1 of
+{{QUIC-TRANSPORT}}. Application protocols could depend on state that is
+retained between resumed connections.
+
+Clients can store any state required for resumption along with the session
+ticket. Servers can use the session ticket to help carry state.
+
+Session resumption allows servers to link activity on the original connection
+with the resumed connection, which might be a privacy issue for clients.
+Clients can choose not to enable resumption to avoid creating this correlation.
+Client SHOULD NOT reuse tickets as that allows entities other than the server
+to correlate connection; see Section C.4 of {{!TLS13}}.
+
+

Looks good. Simple and to the point. My only reservation is about the security section. Session resumption allows tracking by the server, and this is arguably a security issue. The text here properly describes the concern and the remediation, but I wonder whether should there be a mention of these potential privacy issues in the security section.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3566#pullrequestreview-389640637