Re: [TLS] Fate of resumption

+1

For the reasons Peter mentioned.  There are cases where the TLS handshake
is used as an authentication mechanism such as EAP-TLS and other TLS based
EAP mechanisms.  Many deployments rely heavily on session resumption (and
session tickets).  There are also many IoT type devices that support public
key based mechanisms and would benefit from session resumption.

Joe

On Sun, Oct 19, 2014 at 8:43 AM, Erik Nygren <erik+ietf@nygren.org> wrote:

> On Sat, Oct 18, 2014 at 12:16 PM, Eric Rescorla <ekr@rtfm.com> wrote:
>
>> I wanted to get the discussion going on whether we need resumption [0] or
>> not
>> for TLS 1.3. This may be a quick discussion as I suspect the answer is
>> yes, but I figure we should decide it rather than just assuming it.
>>
>
> +1 for leaving in resumption for TLS 1.3, for the reasons mentioned.
>
> Resumption is another part of the "istlsfastyet" story that helps in
> selling
> people on making TLS more ubiquitous, both from a performance
> and cost perspective.  Dropping it at this point might harm adoption
> of both TLS 1.3 as well as momentum towards TLS in general.
>
> (Some of the other discussions on this topic focused on best
> practices around session ticket key management.  If resumption
> is going to stick around, then ideally there should be a BCP or similar
> on sane implementation practices that do as little harm to forward secrecy
> as possible.)
>
> One other thing we may wish to consider is the relative safety
> and complexity and interactions of 0RTT vs Resumption for various
> scenarios,
> such as against replay attacks (when nonces are available and
> when they aren't available).
>
>        Erik
>
>
>
>
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls
>
>