From: Subodh Iyengar <subodh@fb.com>
To: Martin Thomson <martin.thomson@gmail.com>, David Benjamin
 <davidben@chromium.org>
Thread-Topic: [TLS] Remove EncryptedExtensions from 0-RTT
Thread-Index: AQHRzQCOMM43sQV4bE6+w7g/8bWsfp/3UVcAgABEEACAAAdqAIAAYskAgAM9t8I=
Date: Sun, 26 Jun 2016 05:34:04 +0000
Message-ID: <974CF78E8475CD4CA398B1FCA21C8E995655BEB2@PRN-MBX01-4.TheFacebook.com>
References: <CABkgnnVFg2iCc8eWX40+25ATE=dAw3WmndReO0ky2j1K_soLPQ@mail.gmail.com>
 <20160623103546.GA5287@LK-Perkele-V2.elisa-laajakaista.fi>
 <CAF8qwaB6EiP-O3s+pCw9wGHvAH1iFZRQ_GbNJOXwiO2LW4iCvg@mail.gmail.com>
 <CAF8qwaA-XVz-t8G5mos4mm9LfrVjEbh1TKy8n3uKi416t7e_MA@mail.gmail.com>,
 <CABkgnnWEg31RrD+9-NJAg_R4oC9oPz4wWKFoxvhNJEi=9_o-Og@mail.gmail.com>
In-Reply-To: <CABkgnnWEg31RrD+9-NJAg_R4oC9oPz4wWKFoxvhNJEi=9_o-Og@mail.gmail.com>
Accept-Language: en-US
Content-Language: en-US
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Archived-At: <https://mailarchive.ietf.org/arch/msg/tls/0_ecf2T6V4L1gJ-QFBRpHqEBraM>
Cc: "tls@ietf.org" <tls@ietf.org>
Subject: Re: [TLS] Remove EncryptedExtensions from 0-RTT
Precedence: list

Was there a compelling reason to not just put the ticket age in the clear i=
n the CHLO field as @davidben alluded to before. It seems to make it much s=
impler in general.=0A=
=0A=
With support for multiple tickets the server could issue multiple tickets a=
t different times to make time correlation more difficult. The ticket seems=
 to be a more definitive identifier of the user than the time.=0A=
=0A=
Subodh=0A=
________________________________________=0A=
From: TLS [tls-bounces@ietf.org] on behalf of Martin Thomson [martin.thomso=
n@gmail.com]=0A=
Sent: Thursday, June 23, 2016 1:59 PM=0A=
To: David Benjamin=0A=
Cc: tls@ietf.org=0A=
Subject: Re: [TLS] Remove EncryptedExtensions from 0-RTT=0A=
=0A=
On 24 June 2016 at 01:05, David Benjamin <davidben@chromium.org> wrote:=0A=
> I don't think this matters. Just don't reuse tickets. But, if we cared, p=
er=0A=
> the "dumbest possible thing that might work" school of thought, we can=0A=
> replace XOR with addition modulo 2^32. Now ticket reuse leaks the delta=
=0A=
> between two ClientHellos, which, precision aside, was already public=0A=
> information from the receive time (with ticket as correlator). The timest=
amp=0A=
> of the ticket-minting connection is as secret as before.=0A=
=0A=
That sounds like fine reasoning to me.  XOR or addition are both easy=0A=
enough to specify.=0A=
=0A=
_______________________________________________=0A=
TLS mailing list=0A=
TLS@ietf.org=0A=
https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailman=
_listinfo_tls&d=3DCwICAg&c=3D5VD0RTtNlTh3ycd41b3MUw&r=3Dh3Ju9EBS7mHtwg-wAyN=
7fQ&m=3Dryrz7HkNEVNbEb9yKsanQ1ZrOyiVdYuv8BDMJOF55s0&s=3DftTVBbImgxjUem3AV87=
OqX3q_RKQKE1SJ7SGePOhWyc&e=3D=0A=