Handling TLS warning alerts

Martin Thomson <mt@lowentropy.net> Wed, 06 January 2021 05:09 UTC

Return-Path: <mt@lowentropy.net>
X-Original-To: quic@ietfa.amsl.com
Delivered-To: quic@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2C4903A1031 for <quic@ietfa.amsl.com>; Tue, 5 Jan 2021 21:09:52 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.82
X-Spam-Level:
X-Spam-Status: No, score=-2.82 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=lowentropy.net header.b=UyFUKPIM; dkim=pass (2048-bit key) header.d=messagingengine.com header.b=Bh+wV0xZ
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xbX2ceZPFXbv for <quic@ietfa.amsl.com>; Tue, 5 Jan 2021 21:09:50 -0800 (PST)
Received: from out1-smtp.messagingengine.com (out1-smtp.messagingengine.com [66.111.4.25]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 881073A102D for <quic@ietf.org>; Tue, 5 Jan 2021 21:09:50 -0800 (PST)
Received: from compute1.internal (compute1.nyi.internal [10.202.2.41]) by mailout.nyi.internal (Postfix) with ESMTP id E6BD25C01CF for <quic@ietf.org>; Wed, 6 Jan 2021 00:09:49 -0500 (EST)
Received: from imap10 ([10.202.2.60]) by compute1.internal (MEProxy); Wed, 06 Jan 2021 00:09:49 -0500
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=lowentropy.net; h=mime-version:message-id:date:from:to:subject:content-type; s= fm1; bh=HYbEhYzdbhDFGa20QXGKRrmvwzVMO+CVu1FYE6/XfBk=; b=UyFUKPIM JS3u1RRVWKCSBOtrGtjvjut817bJhwdgIJabaGqa84Xbgkeh4eBkzCOgiBun+5pQ X8KlU7spoJEwSaAmOB7csHF3ArisTlWox6Q9x+Go2h20l4NAC4ym3bF0EnBs6xER oLFtRphALf75k9TLOHgpG3s1T2D2Tb7pyfoWlsEGdAzQ4Oa+Awrlm2ozemCuHMEj VGxVehLXv0qGPJW3H9zsnl8QZPOqx91hxivL6Xfteq99DPEBRujqwhkw683b9iPX scm2OhAwfVd+XE6B/I6MBN5RDAdAg6XJouoA86wYQ/wyING8xyQXEVf5feUHAy8m dTT9eJUk2Inlfw==
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=content-type:date:from:message-id :mime-version:subject:to:x-me-proxy:x-me-proxy:x-me-sender :x-me-sender:x-sasl-enc; s=fm1; bh=HYbEhYzdbhDFGa20QXGKRrmvwzVMO +CVu1FYE6/XfBk=; b=Bh+wV0xZC4F6uhtC+g9nvkoBWDTNA1+BLo9hwskjsM7h5 0QPNpj3A7FD51sEw8BAWmK230e+VFJRqNUUaAW41ywzgxgiBNADiIRCkbORS/tPX KZtLcszV6dWkxI132TrA2ybfak/6pCAUE/UERTj92WSOOoJwxrYMEYSRsuhG92xs Hgfs8S/E/DZwARmTVCwaZwNfKgjuTNeWNDF5n0U11OWPbo9YYZwlJUPCsXw6gKBd neRDk/jGXRK/ZmYLzTcOcqACN0Dr7I5habMfiLa7MwetkYffCVcREmtl0wNfYV61 KJEC0g125xYhm1MgRsDENqXNwWvqn3NeJ+7qDc8rA==
X-ME-Sender: <xms:HUb1X7hrKMXstdSsODUQHzAGNnXwUAMIsipIyX8bpBPa4NabX8fenw> <xme:HUb1X4BJk2itOFLlsFXOQSne54GUcnc5MbG4b_0W5sc4ZKhk-p2ypjczcFetJkRsY RV-TXYW44ua702Dy84>
X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgedujedrvdefkedgjeelucetufdoteggodetrfdotf fvucfrrhhofhhilhgvmecuhfgrshhtofgrihhlpdfqfgfvpdfurfetoffkrfgpnffqhgen uceurghilhhouhhtmecufedttdenucenucfjughrpefofgggkfffhffvufgtsehttdertd erredtnecuhfhrohhmpedfofgrrhhtihhnucfvhhhomhhsohhnfdcuoehmtheslhhofigv nhhtrhhophihrdhnvghtqeenucggtffrrghtthgvrhhnpeegueehueejvdeiveffhedvke egffekgffgtdetleefkeeffedtjefhtdduvddutdenucffohhmrghinhepghhithhhuhgs rdgtohhmnecuvehluhhsthgvrhfuihiivgeptdenucfrrghrrghmpehmrghilhhfrhhomh epmhhtsehlohifvghnthhrohhphidrnhgvth
X-ME-Proxy: <xmx:HUb1X7GjH5SqgXQlneXjEc8PvfFYxXNKeJOGzUj_kq-5lue2DoXV4g> <xmx:HUb1X4QkmSgz5sTSGQi1vHNuxiW6WaP3ZmHXYATgQ3C87I-ocx7BUg> <xmx:HUb1X4zo9j3eVKnbOgM-IuMcUjpJ9WWWUAsxyWhrUtSUC_kXHFWqgw> <xmx:HUb1X3-VBeuDyENvwVLNF7aw9wOCuxO5Cw2B4QPeEnboQ_Q7SxOU0w>
Received: by mailuser.nyi.internal (Postfix, from userid 501) id 91FD820066; Wed, 6 Jan 2021 00:09:49 -0500 (EST)
X-Mailer: MessagingEngine.com Webmail Interface
User-Agent: Cyrus-JMAP/3.3.1-61-gb52c239-fm-20201210.001-gb52c2396
Mime-Version: 1.0
Message-Id: <c9306fde-25f1-4e15-b25c-6e84bce6adef@www.fastmail.com>
Date: Wed, 06 Jan 2021 16:09:10 +1100
From: Martin Thomson <mt@lowentropy.net>
To: quic@ietf.org
Subject: Handling TLS warning alerts
Content-Type: text/plain
Archived-At: <https://mailarchive.ietf.org/arch/msg/quic/cdY3oaBLZ99KIFvkZGmI-dwFUE0>
X-BeenThere: quic@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Main mailing list of the IETF QUIC working group <quic.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/quic>, <mailto:quic-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/quic/>
List-Post: <mailto:quic@ietf.org>
List-Help: <mailto:quic-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/quic>, <mailto:quic-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 06 Jan 2021 05:09:52 -0000

At the risk of this getting lost in the snowstorm of emails flying around, it's worth highlighting a change that I'm proposing in response to Ben's review of -tls:

https://github.com/quicwg/base-drafts/pull/4570

I'll include the change here, because it mostly speaks for itself:

OLD:
The alert level of all TLS alerts is "fatal"; a TLS stack MUST NOT generate
alerts at the "warning" level.

NEW:
QUIC is only able to convey an alert level of "fatal". The only existing uses
for the "warning" level are to signal connection close; see Section 6.1 of
{{!TLS13}}. As QUIC provides alternative mechanisms for connection termination
and the TLS connection is only closed if an error is encountered, a QUIC
endpoint MUST treat any alert from TLS as if it were at the "fatal" level.

The change is from levying a requirement on TLS implementations and making it a requirement on how QUIC reacts to TLS.  Though the requirement we had is likely consistent with what TLS implementations actually would do, it's overreaching our authority, and unnecessarily so.  This has almost the same effect, though it's also clearer in terms of outcomes.