Re: [TLS] Call for consensus: Removing 0-RTT client auth

[Bill Cox <[e-mail]>]

On Thu, Apr 7, 2016 at 8:32 AM, Bill Cox <[e-mail]> wrote:

> I've been reviewing this issue because I want to help figure out how to do
> token binding over TLS 1.3 PKS 0-RTT.  When the server emulates a session
> cache, then the RMS is unique on every PSK 0-RTT resumption.  That means
> the client handshake hash is also unique, and it therefore becomes an
> attractive value for the purpose of signing.  If we allow client auth in
> this mode, we gain some security.  In particular, without access to the
> client cert private key, an attacker cannot resume a session, even if they
> have the RMS.
>
> Give this possible mode of operation, we may want to consider keeping
> client auth as an option in 0-RTT PSK resumption.
>

This brings up another issue: the client does not currently know if the
server is running stateless or if it has some form of replay protection.
It was proposed on another thread to add this information to the new ticket
with a 1-byte type.  I think this is a good idea.

With replay protection, allowing client auth makes some sense.  The server
loses freshness, but not uniqueness of the signature, and uniqueness is the
more important of the two properties IMO.  Without replay protection, only
the initial 1-RTT signature actually proves possession of the private key,
so we should probably not allow client auth on PSK 0-RTT in that case and
instead advise the client to secure the RMS well, since it can be used to
resume authenticated sessions without the client private key.  Without
extending the ticket format to provide this information to the client, it
will not be possible to make this differentiation, and either we will have
to disallow all 0-RTT client auth for replay-resistant servers, or we will
have to require all servers supporting 0-RTT to provide a client signature,
even when running stateless.  Given that stateless 0-RTT client auth does
not prove possession of the private key, I would prefer not to allow it in
that mode.

Bill