Re: [TLS] Updated DTLS draft

[Matt Caswell <[e-mail]>]

On 13 March 2017 at 23:41, Eric Rescorla <[e-mail]> wrote:
> I have just posted a new version of the DTLS 1.3 draft, updated for
> draft-19.
> It's still very rough with a lot of open issues (some of which are even
> noted
> in the draft), and no doubt contains egregious errors.
>
> https://tools.ietf.org/html/draft-rescorla-tls-dtls13-01
>
> As usual, comments welcome.

Section 5.1

The cookie mechanism is meant to be entirely stateless on the server side.
However as it is currently specified it is not (and in fact DTLS1.2 suffers from
the same issue). The problem is that the ClientHello may be fragmented. In order
to reassemble it the server must allocate state.

In OpenSSL 1.1.0 for DTLS1.2 we require that the cookie is entirely held within
the first fragment of the ClientHello. This way the cookie can be validated
without needing to fully reassemble the message (assuming the cookie validation
function does not need any information contained within a later fragment). Only
once the cookie is validated do we then attempt to reassemble the rest of the
ClientHello.

If the cookie is not held within the first fragment then we drop the packet.

OpenSSL prior to 1.1.0 can't handle a fragmented DTLS ClientHello at
all (when running
in stateless mode - we have the option of running stateful which does work).

We kind of get away with this for DTLS1.2. The cookie is relatively
early in the CH
message (i.e. prior to ciphersuites etc). So a CH would have to be fairly
significantly fragmented for it to be a problem.

In DTLS1.3 the cookie is now (potentially) much larger and appears much later in
the ClientHello, making it much more likely that it will not fall
fully within the
first fragment. This could mean a fully stateless solution is impossible.

Matt