Re: [secdir] Secdir review of draft-ietf-tls-record-limit

Alan DeKok <aland@deployingradius.com> Fri, 23 February 2018 14:49 UTC

Return-Path: <aland@deployingradius.com>
X-Original-To: secdir@ietfa.amsl.com
Delivered-To: secdir@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 62EF8127337; Fri, 23 Feb 2018 06:49:16 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.901
X-Spam-Level:
X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id J47junh1KSmV; Fri, 23 Feb 2018 06:49:14 -0800 (PST)
Received: from mail.networkradius.com (mail.networkradius.com [62.210.147.122]) by ietfa.amsl.com (Postfix) with ESMTP id 5B4C01270A3; Fri, 23 Feb 2018 06:49:14 -0800 (PST)
Received: from [192.168.2.28] (198-84-205-59.cpe.teksavvy.com [198.84.205.59]) by mail.networkradius.com (Postfix) with ESMTPSA id 2FA9D1FE8; Fri, 23 Feb 2018 14:49:13 +0000 (UTC)
Content-Type: text/plain; charset=us-ascii
Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\))
From: Alan DeKok <aland@deployingradius.com>
In-Reply-To: <CABkgnnVYbK-==zHyUTPiWxQ_so9XepWKpUpdd=1-OsJuv_0VFQ@mail.gmail.com>
Date: Fri, 23 Feb 2018 09:49:11 -0500
Cc: draft-ietf-tls-record-limit@ietf.org, IESG <iesg@ietf.org>, secdir@ietf.org
Content-Transfer-Encoding: quoted-printable
Message-Id: <F9726F86-DF0E-46DE-B0E4-F688C7D9A51C@deployingradius.com>
References: <5C2E06FE-8685-457D-ACED-5600092C1CB1@deployingradius.com> <CABkgnnVYbK-==zHyUTPiWxQ_so9XepWKpUpdd=1-OsJuv_0VFQ@mail.gmail.com>
To: Martin Thomson <martin.thomson@gmail.com>
X-Mailer: Apple Mail (2.3124)
Archived-At: <https://mailarchive.ietf.org/arch/msg/secdir/c_U-KkNjmGDUBoQdJACJvQX_u4g>
Subject: Re: [secdir] Secdir review of draft-ietf-tls-record-limit
X-BeenThere: secdir@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: Security Area Directorate <secdir.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/secdir>, <mailto:secdir-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/secdir/>
List-Post: <mailto:secdir@ietf.org>
List-Help: <mailto:secdir-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/secdir>, <mailto:secdir-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 23 Feb 2018 14:49:16 -0000

On Feb 22, 2018, at 8:19 PM, Martin Thomson <martin.thomson@gmail.com>; wrote:
> A few changes based on your feedback here:
> https://github.com/tlswg/tls-record-limit/pull/17

  Thanks. That helps.

> The remainder of the paragraph is intended to make that distinction
> clear.  i.e., this limit is inherently fixed by negotiation, the other
> is dynamic.

  My point is that those two limits may agree or disagree dynamically.  So it would be good to give guidance on what to do when a previous agreement dynamically changes to disagreement.

>> Comment:  it would be good to give guidance on what to do here, and what happens in error cases.
> 
> DTLS (RFC 6347) already has some fairly extensive guidance on PMTUD,
> which I didn't want to replicate here.  You hit a lot of the issues in
> your questions.  With some better citations, this is what I came up
> with:

  That still doesn't give guidance.  What happens if the record size limit is fine at the start of a session, and then MTU changes, and the packets no longer make it through?   What does the application do?

  RFC 6347 Section 4.1.1.1 gives some guidance, but I think not enough.  Exposing the MTU to the application is good, but what does the application *do* with this information?

  e.g. PMTU should be exposed to the application as per Section 4.1.1.1 of {{?DTLS}}.  If the PTMU changes, the application may discover that the new MTU is smaller than the record size limit.  In that situation, the only recourse available may be to close the session, and to open a newer one with a smaller record size limit that is compatible with the new MTU.

  Alan DeKok.