Re: [tcpinc] Eric Rescorla's Discuss on draft-ietf-tcpinc-tcpcrypt-09: (with DISCUSS and COMMENT)

[Daniel B Giffin <[e-mail]>]

Whether or not we decide to go back to the WG to discuss the
mechanics of session resumption, we could make lightweight
changes to the current protocol in this last call that would
facilitate any "upgrades" that appear necessary after
deployment has begun.

To wit, we propose:

  - Replace the first byte of INIT1_MAGIC and INIT2_MAGIC
    with a "version" byte.  Implementations of the current
    protocol must send a zero version-byte, and must ignore
    what they receive.

  - When receiving ENO suboptions for tcpcrypt TEPs with
    v=1, which are "resumption suboptions": if the
    resumption identifier-half is not the expected length
    (9 bytes), treat this suboption as a bare TEP byte with
    v=0; that is, an invitation to fresh key-exchange with
    that TEP.  This *almost* goes without saying; the
    current draft doesn't say what to do in this case of
    "malformatted" resumption identifiers.

The version byte is intended to allow implementations of
future protocol versions to identify each other (by sending
the highest version they support), which then allows them to
perform "advanced" resumption signaling later.

And specifying how "advanced" resumption suboptions collapse
into simple TEP advertizements (instead of being ignored
altogether) ensures backwards compatibility with the current
protocol, even without the version mechanism.

These changes would permit several backwards-compatible
resumption mechanisms to be added later:

  - Ekr's idea to send nonces on the first ACK in each
    direction
  - David Black's idea to combine some nonce-bytes with the
    resumption identifiers
  - Ekr's idea to send nonces in an extra handshake in the
    TCP datastream

Again, we don't intend to reject the possibility of more
agressive changes, but if we want to go ahead with something
now then the above minor changes provide an upgrade path if
it becomes necessary.

If this sounds attractive, the above changes can be added to
the new draft (ready in the next 24 hours) that addresses
recent reviews.

d