Re: [TLS] Maximum Fragment Length negotiation

[Thomas Pornin <[e-mail]>]

On Thu, Nov 24, 2016 at 09:10:00PM +0000, Fossati, Thomas (Nokia - GB)
wrote:
> I like your proposal, but I'm not convinced that overloading the
> semantics of an already existing extension when used in combination
> with a specific version of the protocol is necessarily the best
> strategy.  Besides, I'd like to be able to deploy a similar mechanism
> in 1.2.

Defining a new extension is certainly possible. However, it would then
require deciding on the intended behaviour when both that new extension
and the RFC 6066 extension are present.

Tentatively, one could try this:

  - The new extension documents the maximum record length supported
    by whoever sends it. Encoding is as in RFC 6066: one byte of
    value x for a maximum record plaintext length of 2^(x+8) bytes).
    We extend that to the whole 1..8 range so that larger records
    may be used by implementations who can afford them and obtain
    some performance increase by doing so (actual maximum plaintext
    length will be slightly less than 65535 bytes becose the length
    header is 16-bit and there must be some room for the MAC).

  - If a client sends both the RFC 6066 extension and the new extension,
    and the server supports the new extension, then the RFC 6066
    extension is ignored and only the new extension is used. A server
    MUST NOT send both extensions.

  - All implementations that support the extension MUST have the
    ability to apply a shorter size limit than their maximum limit
    (this is for _sending_ records).

  - The length sent by the server is the one that will be applied to
    subsequent records on the connection, in both directions. This
    applies to the whole connection, including subsequent handshakes
    (renegotiations), unless both client and server send the new
    extension again in a renegotiation (in which case the new length
    appplies).

  - If using TLS 1.3, then the following extra rules apply:

     - All TLS 1.3 implementations MUST support the extension.

     - If the client does not send the new extension, then this is
       equivalent to the client sending the new extension with a
       value of 6 (i.e. maximum plaintext length is 2^14 = 16384 bytes).
       In particular, this allows the server to send the extension.

     - If the server does not send the new extension, then this is
       equivalent to the server sending the new extension with the
       same value as the one from the client. (So, if neither sends
       the extension, then the usual 16384-byte limit applies.)

  - If using TLS 1.2 or a previous version, then there is no implicit
    usage:

     - The server MUST NOT send the new extension unless the client sent
       it.

     - The maximum plaintext limit shall be enforced only if the server
       sent the extension; that limit is the one defined by the server's
       extension.

     - If the client and/or the server does not send the extension, then
       the maximum plaintext length is the one that was in force at that
       point, i.e. 16384 bytes for a new connection, or whatever was
       used before the new handshake in case of renegotiation.

Some noteworthy points:

  * TLS 1.3 has no renegotiation, so the renegotiation behaviour is
    for TLS 1.2 and previous. This avoids tricky issues with the
    TLS 1.3 implicit behaviour in case of renegotiation.

  * A client SHOULD send the new extension in all ClientHello if it
    is ready to use TLS 1.2 or previous, so that a non-1.3-aware
    server may have the possibility to negotiate a shorter maximum
    plaintext length.

  * The initial ClientHello may use records larger than what the server
    is willing to accept, and before the server has any chance to
    advertise its own maximum record size. However, since the initial
    records are unprotected, implementations may be able to process
    partial records, and thus could accept un-MACed records larger
    than their incoming buffer (at least BearSSL can do that).


The "implicit" behaviour (both for client and server) with TLS 1.3 is a
way to make the extension free (with regards to network usage) in the
common case. It cannot be applied unless the extension support is made
mandatory for TLS 1.3. Making it mandatory is also an important feature,
since otherwise such an extension would likely remain unimplemented
by "big" clients (e.g. Web browsers).


Any comments?
I can try to write the corresponding text for inclusion in the TLS 1.3
draft. What is the process for submitting such text?


	--Thomas Pornin