[saag] TLS report

["Christopher Wood" <[e-mail]>]

TLS met Thursday morning and will meet again Thursday afternoon. 

TLS External PSK was discussed. There was agreement to revise the document and move forward with a few minor revisions.  The WG will also start a design team to document and clarify external PSK usage and more sophisticated mitigations for Selfie-style attacks. Final updates to the Exported Authenticators draft were presented based on last call comments. An existing PR to clarify comments exists yet did not have consensus in the room. Discussion on the list will continue. Changes to the Delegated Credentials (DC) draft were presented. The WG seems to be in favor of adding a signature algorithms list to the DC extension citing possible benefits for semi-static DH as a use case. 

The WG received new work on an extended key schedule for TLS 1.3 to support better security and consistency for additional use cases such as Hybrid Key Exchange, ESNI, External PSK, and Semi-Static DH. The design injects secret into key schedule in a predictable and composable way. There will be more discussion on the list. Compact TLS (cTLS) was presented. The design introduces a variety of changes (removal of legacy fields, variable-length encoding, pre-defined extensions) that aim to help better use TLS in other contexts, such as QUIC, LAKE, and EAP.  Strong support in the room to adopt this in the working group pending rechartering.  A proposal on a 1-RTT Semi-Static DH handshake mode was presented.  There was support to adopt this draft as a WG item. The WG will confirm on the list. A new proposal for batch signing was presented.  There was support to adopt this draft as a WG item. The WG will confirm on the list.

The afternoon TLS session will cover Encrypted SNI and the ongoing work to deprecate MD5+SHA1 signature hash algorithms. 

Best,
Chris