Re: [Tls-reg-review] Adopting tls-flags

Christopher Wood <caw@heapingbits.net> Tue, 30 March 2021 14:33 UTC

Return-Path: <caw@heapingbits.net>
X-Original-To: tls-reg-review@ietfa.amsl.com
Delivered-To: tls-reg-review@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B4B7E3A1691; Tue, 30 Mar 2021 07:33:28 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.12
X-Spam-Level:
X-Spam-Status: No, score=-2.12 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=heapingbits.net header.b=0a5I3jbV; dkim=pass (2048-bit key) header.d=messagingengine.com header.b=l6NlqhHT
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zyM6_njipp_g; Tue, 30 Mar 2021 07:33:24 -0700 (PDT)
Received: from out1-smtp.messagingengine.com (out1-smtp.messagingengine.com [66.111.4.25]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A898B3A1689; Tue, 30 Mar 2021 07:33:23 -0700 (PDT)
Received: from compute4.internal (compute4.nyi.internal [10.202.2.44]) by mailout.nyi.internal (Postfix) with ESMTP id 3B0B45C0197; Tue, 30 Mar 2021 10:33:21 -0400 (EDT)
Received: from imap4 ([10.202.2.54]) by compute4.internal (MEProxy); Tue, 30 Mar 2021 10:33:21 -0400
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=heapingbits.net; h=mime-version:message-id:in-reply-to:references:date:from:to :cc:subject:content-type:content-transfer-encoding; s=fm1; bh=k9 36aVTw2/e1ppqK9aF3pWQEYyJplNwtXf8Kqg0v1Sk=; b=0a5I3jbVTc912ihovn 0k3kvyD7LaGRO+HwTTUrflzwE0/+MVwIAx1QvkLCVIq4Fdm2T0N7gUsOHuogBe9m 1KU71ZO9tUwcUS4oMY4Ljrh0/XVreh8WCZZT2HXbQwQxozGccE/OKiQgeYLEAfb2 eAcgWGhDhnyYwclYcVJRiO8H9BJYet4rHievwIokslbX0cwFWxQYot+KPqX9fGvK VJtfeMB0EBYTSHvTwuem3+kEfaYFwNhtI8xjy83J+YG7BlXTWXZKTyELm2XaF90Y oLzKtnPFLh1LiIWryqGsqiErfbo4DYyfJUAOBvrteUHFZHw3Jve3o6dp6GUlWVcz N0vg==
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:content-transfer-encoding:content-type :date:from:in-reply-to:message-id:mime-version:references :subject:to:x-me-proxy:x-me-proxy:x-me-sender:x-me-sender :x-sasl-enc; s=fm2; bh=k936aVTw2/e1ppqK9aF3pWQEYyJplNwtXf8Kqg0v1 Sk=; b=l6NlqhHT9fP+TuxmbFORyGFZv+z3Jdv3d2QQce4moDP6iTwKCD8EvArl4 kU8wlfnfokFsJPD1+nlJdj+KNxARbETzNMgUp9bRZddN2jkF7HSdhZ251Z7/bGNP 2xmEIhXBewdPNGy8rVhtaogU8b86Q9Iqe8sAyBem4ULblnT1hamVMh2PNd3PUR18 zvpEZCgTcZC9xbpMRQojB5W5M388RdwLeSK3yvrT1DLqvhk7AzFoOnDxNcGt8l1T xBwpqQ/bTkZfSrb5mQnlo8OKHPgZKaL9QCmYFAGnC6WkajLuSwRAUvuZj879ZXmR EukKPSSpqmm+ufe3qnvnU9OGjoLtA==
X-ME-Sender: <xms:sDZjYBnCd8XptaMxjTsBL5357utNKXMW9gJAHPQ0x6mbUJnbXM-W5Q> <xme:sDZjYM02YpF_Rxa8gmozjXFqIJC-GZd5CXBf8DOnSgxrNfYqS_bR66-LGWe_aj3mO YAbJK_4LKcL3aZ-zWk>
X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgeduledrudeitddgjeekucetufdoteggodetrfdotf fvucfrrhhofhhilhgvmecuhfgrshhtofgrihhlpdfqfgfvpdfurfetoffkrfgpnffqhgen uceurghilhhouhhtmecufedttdenucesvcftvggtihhpihgvnhhtshculddquddttddmne cujfgurhepofgfggfkjghffffhvffutgfgsehtqhertderreejnecuhfhrohhmpedfvehh rhhishhtohhphhgvrhcuhghoohgufdcuoegtrgifsehhvggrphhinhhgsghithhsrdhnvg htqeenucggtffrrghtthgvrhhnpeetiedvlefffedtvdelhfdthfdvgfetffehtdejlefg heekleelvdduffeltdelkeenucffohhmrghinhepihgvthhfrdhorhhgnecuvehluhhsth gvrhfuihiivgeptdenucfrrghrrghmpehmrghilhhfrhhomheptggrfieshhgvrghpihhn ghgsihhtshdrnhgvth
X-ME-Proxy: <xmx:sDZjYHrbaWZzWLKVd6CzOiU3VoxphC5EuanbV4SdfmP4s4WYPdFEnA> <xmx:sDZjYBl7nRvYiSq86WMGEGIH22NneUk4ipIznGupFqKXV6n2nijQEA> <xmx:sDZjYP2j9aPMOy8JD6fJv4X5xqq_TgLm8JYOL2vHoFzMd0xne0tu3w> <xmx:sTZjYAyZj2vpAbTroJY2u6me_ryP4Ex27CFixppbIh66GCO0_jjeNA>
Received: by mailuser.nyi.internal (Postfix, from userid 501) id EC9BE160060; Tue, 30 Mar 2021 10:33:19 -0400 (EDT)
X-Mailer: MessagingEngine.com Webmail Interface
User-Agent: Cyrus-JMAP/3.5.0-alpha0-273-g8500d2492d-fm-20210323.002-g8500d249
Mime-Version: 1.0
Message-Id: <e8c96ac1-b9cc-4aa2-8d35-bba149dffed7@www.fastmail.com>
In-Reply-To: <20210330143102.GZ79563@kduck.mit.edu>
References: <CAAZdMadAGa=X5+ktAUjr-=fvxrpQwRfERHbpR4+6KfXeiWxAGw@mail.gmail.com> <7fb3a536-6716-4f55-82ed-2c4b96669166@www.fastmail.com> <b1a39bbf-23b8-472c-9565-20479ee7b262@www.fastmail.com> <CAAZdMad7A3fJG9GyNrXgSnsnC-wHN5_V4wpaOqWwAtUGzWtbsw@mail.gmail.com> <1f78ab86-8e27-4d8a-b670-b1a5d6432eb0@www.fastmail.com> <20210319203859.GF79563@kduck.mit.edu> <E37616E0-5199-4258-BCAB-DFF9B3C5C14C@gmail.com> <3c7eeed5-a559-4f12-a2a6-19b7cc41c2e7@www.fastmail.com> <a91a607d-ae01-46ac-bea8-2f78a5200665@www.fastmail.com> <FA2A69DB-2AA1-4605-971A-A76B8177EF1E@gmail.com> <20210330143102.GZ79563@kduck.mit.edu>
Date: Tue, 30 Mar 2021 07:32:59 -0700
From: Christopher Wood <caw@heapingbits.net>
To: Benjamin Kaduk <kaduk@mit.edu>
Cc: Yoav Nir <ynir.ietf@gmail.com>, Victor Vasiliev <vasilvv@google.com>, "tls-reg-review@ietf.org" <tls-reg-review@ietf.org>, draft-ietf-tls-cross-sni-resumption@ietf.org, TLS Chairs <tls-chairs@ietf.org>
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable
Archived-At: <https://mailarchive.ietf.org/arch/msg/tls-reg-review/7yPyS0Tsfv5TcCmgwPQsCa0Qyco>
Subject: Re: [Tls-reg-review] Adopting tls-flags
X-BeenThere: tls-reg-review@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: TLS REVIEW <tls-reg-review.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls-reg-review>, <mailto:tls-reg-review-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls-reg-review/>
List-Post: <mailto:tls-reg-review@ietf.org>
List-Help: <mailto:tls-reg-review-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls-reg-review>, <mailto:tls-reg-review-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 30 Mar 2021 14:33:29 -0000

I totally do not feel strongly about the outcome here. I would just like to see this resolved. 

Victor, Yoav: can you please coordinate and make changes (one way or another)?

Thanks!
Chris

On Tue, Mar 30, 2021, at 7:31 AM, Benjamin Kaduk wrote:
> I am also unsure what was requested of whom ... I think my proposal was
> that the cross_sni_resumption value would be listed in the tlsflags draft
> and also used in the cross-sni-resumption draft, and we can work out the
> details based on which one is published first.
> 
> -Ben
> 
> On Tue, Mar 30, 2021 at 04:26:18PM +0300, Yoav Nir wrote:
> > Are you waiting for Ben to clarify the suggestion or for me to say if it will work?
> > 
> > It works for me either way.
> > 
> > > On 30 Mar 2021, at 16:15, Christopher Wood <caw@heapingbits.net> wrote:
> > > 
> > > Bump!
> > > 
> > > On Mon, Mar 22, 2021, at 7:04 AM, Christopher Wood wrote:
> > >> On Sat, Mar 20, 2021, at 9:57 PM, Yoav Nir wrote:
> > >>> You mean add the cross_sni_resumption value to the tlsflags draft?  
> > >> 
> > >> I don't think that was the suggestion. I understand the proposal to be:
> > >> 
> > >> 1. tls-flags owns the registry and its initial contents, and it's 
> > >> initially empty empty.
> > >> 2. cross-sni-resumption defines the first registry value for tls-flags, 
> > >> with value 8.
> > >> 
> > >> Did I misunderstand? If not, would that work?
> > >> 
> > >> Best,
> > >> Chris
> > >> 
> > >>> Sure. We can do that, if we’re sure that the cross-sni-resumption draft 
> > >>> is getting approved in this form.  I don’t think there has been a WGLC 
> > >>> for it yet.
> > >>> 
> > >>> Also, section 4.1 of the TLSFLAGS draft has this advice:
> > >>> 
> > >>> 4.1.  Guidance for IANA Experts
> > >>> 
> > >>>   This extension allows up to 2040 flags.  However, they are not all
> > >>>   the same, because the length of the extension is determined by the
> > >>>   highest set bit.
> > >>> 
> > >>>   We would like to allocate the flags in such a way that the typical
> > >>>   extension is as short as possible.  The scenario we want to guard
> > >>>   against is that in a few years some extension is defined that all
> > >>>   implementations need to support and that is assigned a high number
> > >>>   because all of the lower numbers have already been allocated.  An
> > >>>   example of such an extension is the Renegotiation Indication
> > >>>   Extension defined in [RFC5746].
> > >>> 
> > >>>   For this reason, the IANA experts should allocate the flags as
> > >>>   follows:
> > >>> 
> > >>>   o  Flags 0-7 are reserved for documents coming out of the TLS working
> > >>>      group with a specific request to assign a low number.
> > >>> 
> > >>>   o  Flags 8-31 are for standards-track documents that the experts
> > >>>      believe will see wide adoption among either all users of TLS or a
> > >>>      significant group of TLS users.  For example, an extension that
> > >>>      will be used by all web clients or all smart objects.
> > >>> 
> > >>>   o  Flags 32-63 are for other documents, including experimental, that
> > >>>      are likely to see significant adoption.
> > >>> 
> > >>>   o  Flags 64-79 are not to be allocated.  They are for reserved for
> > >>>      private use.
> > >>> 
> > >>>   o  Flags 80-2039 can be used for temporary allocation in experiments,
> > >>>      for flags that are likely to see use only in very specific
> > >>>      environments, for national and corporate extensions, and as
> > >>>      overflow, in case one of the previous categories has been
> > >>>      exhausted.
> > >>> 
> > >>> 
> > >>> So IMO this is more fitting to receive the number 8 rather than the 
> > >>> number 1. That is, unless the WG wants to make the case that this flag 
> > >>> extension is going to be present in most ClientHello messages from now 
> > >>> on.
> > >>> 
> > >>> Yoav
> > >>> 
> > >>>> On 19 Mar 2021, at 22:38, Benjamin Kaduk <kaduk@mit.edu> wrote:
> > >>>> 
> > >>>> The draft that creates the registry owns the initial registry contents
> > >>>> until the registry itself is created.
> > >>>> 
> > >>>> So, just put the value in the draft's source, and try to avoid re-using a
> > >>>> number for different things during the draft's time as a draft.
> > >>>> 
> > >>>> -Ben
> > >>>> 
> > >>>> On Fri, Mar 19, 2021 at 01:26:10PM -0700, Christopher Wood wrote:
> > >>>>> + tls-reg-review
> > >>>>> 
> > >>>>> Good question! Since this is a new registry, I don't see any problem with grabbing 1 to populate it. The registry experts may have a better answer though.
> > >>>>> 
> > >>>>> Best,
> > >>>>> Chris
> > >>>>> 
> > >>>>> On Thu, Mar 18, 2021, at 5:06 PM, Victor Vasiliev wrote:
> > >>>>>> Do I actually get to just use 1, or do I need to ask you to do the 
> > >>>>>> early allocation process?
> > >>>>>> 
> > >>>>>> On Tue, Mar 16, 2021 at 9:50 PM Christopher Wood <caw@heapingbits.net> wrote:
> > >>>>>>> Friendly bump!
> > >>>>>>> 
> > >>>>>>> On Mon, Mar 1, 2021, at 7:52 AM, Christopher Wood wrote:
> > >>>>>>>> Hi Victor,
> > >>>>>>>> 
> > >>>>>>>> On Mon, Mar 1, 2021, at 7:39 AM, Victor Vasiliev wrote:
> > >>>>>>>>> Hi Chris,
> > >>>>>>>>> 
> > >>>>>>>>> This makes sense.  I will update the draft some time after the upcoming 
> > >>>>>>>>> IETF.  Do you want to just add a codepoint reserved for cross-domain 
> > >>>>>>>>> resumption into the draft, or how does that work?
> > >>>>>>>> 
> > >>>>>>>> Good question. I suspect your draft would just add, in the IANA 
> > >>>>>>>> considerations section, something like this:
> > >>>>>>>> 
> > >>>>>>>> ~~~
> > >>>>>>>> This document requests that IANA create a new entry in "TLS Flags" 
> > >>>>>>>> registry with the following parameters:
> > >>>>>>>> 
> > >>>>>>>> - Value: 1
> > >>>>>>>> - Flag Name: "cross_sni_resumption" (or whatever you want to name it)
> > >>>>>>>> - Message: NewSessionTicket
> > >>>>>>>> - Recommended: Y
> > >>>>>>>> - Reference: This document
> > >>>>>>>> ~~~
> > >>>>>>>> 
> > >>>>>>>> (See https://tools.ietf.org/html/draft-ietf-tls-tlsflags-04#section-4)
> > >>>>>>>> 
> > >>>>>>>>> 
> > >>>>>>>>> (sorry for late response, just noticed the part about the draft  submission deadline)
> > >>>>>>>> 
> > >>>>>>>> No problem!
> > >>>>>>>> 
> > >>>>>>>> Best,
> > >>>>>>>> Chris
> > >>>>>>>> 
> > >>>>> 
> > >>>>> _______________________________________________
> > >>>>> tls-reg-review mailing list
> > >>>>> tls-reg-review@ietf.org
> > >>>>> https://www.ietf.org/mailman/listinfo/tls-reg-review
> > >>>> 
> > >>>> _______________________________________________
> > >>>> tls-reg-review mailing list
> > >>>> tls-reg-review@ietf.org
> > >>>> https://www.ietf.org/mailman/listinfo/tls-reg-review
> > >>> 
> > >> 
> > 
>