Re: [TLS] TLS1.3 status/expectations

[Eric Rescorla <[e-mail]>]

On Tue, Mar 1, 2016 at 7:01 PM, Martin Thomson <[e-mail]>
wrote:

> On 2 March 2016 at 13:55, Eric Rescorla <[e-mail]> wrote:
> > I think a "safer" profile of TLS, as in "implement the following features
> > (section XXX, YYY) and not the following (section ZZZ)" then that seems
> like
> > something that might potentially be a useful exercise. Depending on
> length,
> > this might eventually make sense to pull into TLS 1.3 as an appendix or
> just
> > leave as a self-contained document.
>
> Yeah, something like this would have been very helpful for TCPINC.  Or
> for protocols like COAP.
>
> I think that a description of the "good parts" of TLS 1.3 would be a
> relatively short document if it were self-contained.  The core is
> pretty simple.
>

Reading this over, I wonder if we're talking about the same thing. It's
probably my fault for
using the word "self-contained" here, so in the interest of clarifying,
what I meant here was
 "separate".

Specifically, I think it's not going to work well to have a document that
(for instance)
replicates the rules about wire encodings, crypto, etc. [0]  I do think it
would probably
be OK to have a document that profiled TLS 1.3 and then referred to the
relevant
sections in the main document for details.

-Ekr


[0] Though of course simplifications to this text are welcome.




> Though, as ekr mentioned, copying the main spec could be bad.  The
> point of something like this is to create something that would talk to
> a full implementation, not to create a protocol fork.
>