Re: [TLS] Comments on TLS extension mechanism

Kyle Hamilton wrote:
> I would like to request that a specific TLS extension number, say
> 65534, be used as a means of negotiating arbitrary TLS extensions for
> specific application and research purposes, with the express
> understanding that this mechanism SHOULD NOT be used unless no other
> option presents itself, AND the implementor is aware of any potential
> security issues that may be introduced.  The format I propose would be
> akin to:
> 
> struct {
>   int extension_ID,
>   OID arbitrary_extension,
>   int extension_data_length(65535)
>   opaque(arbitrary_extension_data)
> } TlsArbitraryExtensionType;
> 
> Since section 5 of RFC4366 (and predecessors) states that new
> extensions shall ONLY be approved through RFCs approved by the IESG,
> this is the only logical place to propose such that I can find.

Why would we want to approve an extension that essentially bypasses
the current approval policy, which was agreed by concensus of the
TLS WG, and that also increases the parsing complexity of such extensions
for no good reason?

There is no extension ID scarcity problem. The policy for approval of
new extensions is exactly as intended, and the lack of an experimental
ID range is quite deliberate:

   The list of extension types, as defined in Section 2.3, is maintained
   by the Internet Assigned Numbers Authority (IANA).  Thus, an
   application needs to be made to the IANA in order to obtain a new
   extension type value.  Since there are subtle (and not-so-subtle)
   interactions that may occur in this protocol between new features and
   existing features that may result in a significant reduction in
   overall security, new values SHALL be defined only through the IETF
   Consensus process specified in [IANA].

   (This means that new assignments can be made only via RFCs approved
   by the IESG.)

-- 
David Hopwood <david.nospam.hopwood@blueyonder.co.uk>

_______________________________________________
TLS mailing list
TLS@lists.ietf.org
https://www1.ietf.org/mailman/listinfo/tls