IETF Logo Mail Archive

Re: [TLS] draft-ietf-tls-cached-info-02 / New "Fast-Track" draft posted

Simon Josefsson <simon@josefsson.org> Tue, 02 February 2010 13:19 UTC

Return-Path: <simon@josefsson.org>
X-Original-To: tls@core3.amsl.com
Delivered-To: tls@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id D682E3A6940 for <tls@core3.amsl.com>; Tue, 2 Feb 2010 05:19:26 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.599
X-Spam-Level:
X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id sHvnB2Dd+36Y for <tls@core3.amsl.com>; Tue, 2 Feb 2010 05:19:24 -0800 (PST)
Received: from yxa-v.extundo.com (yxa-v.extundo.com [83.241.177.39]) by core3.amsl.com (Postfix) with ESMTP id EA5CE3A6885 for <tls@ietf.org>; Tue, 2 Feb 2010 05:19:21 -0800 (PST)
Received: from mocca (c80-216-24-99.bredband.comhem.se [80.216.24.99]) (authenticated bits=0) by yxa-v.extundo.com (8.14.3/8.14.3/Debian-5+lenny1) with ESMTP id o12DJmC0015842 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES128-SHA bits=128 verify=NOT); Tue, 2 Feb 2010 14:19:51 +0100
From: Simon Josefsson <simon@josefsson.org>
To: Brian Smith <brian@briansmith.org>
References: <001901caa3e4$c0363750$40a2a5f0$@org>
OpenPGP: id=B565716F; url=http://josefsson.org/key.txt
X-Hashcash: 1:22:100202:brian@briansmith.org::UduBA4NKoh3v/IYb:DJ7b
X-Hashcash: 1:22:100202:tls@ietf.org::sYXNGrha77tgDvsL:Jpdq
Date: Tue, 02 Feb 2010 14:19:48 +0100
In-Reply-To: <001901caa3e4$c0363750$40a2a5f0$@org> (Brian Smith's message of "Tue, 2 Feb 2010 02:50:15 -0600")
Message-ID: <874olzn5aj.fsf@mocca.josefsson.org>
User-Agent: Gnus/5.110011 (No Gnus v0.11) Emacs/23.1 (gnu/linux)
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
X-Virus-Scanned: clamav-milter 0.95.3 at yxa-v
X-Virus-Status: Clean
Cc: tls@ietf.org
Subject: Re: [TLS] draft-ietf-tls-cached-info-02 / New "Fast-Track" draft posted
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/tls>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 02 Feb 2010 13:19:27 -0000

"Brian Smith" <brian@briansmith.org> writes:

> I am very interested in the ideas that motivate the cached info extension.

Stefan can speak for his reasons, but I see significant advantage in
being able to cache the list of trusted CA certs that is sent from
server to client.  For whatever reasons (which likely include poor
server configuration), I've seen TLS handshakes in the wild that are as
large as 30-40kb which cause some operational pains.

The server certificate _chain_ (note that it is the entire chain that is
cached, not just the server certificate) also has potential of being
large (and growing over time, it seems, as more and more interesting
X.509 extensions are added).

I'm not sure how this relates to the rest of your e-mail though...

/Simon

v2.23.0 | Report a Bug | By Email