Re: [TLS] New Cached info draft

["Brian Smith" <[e-mail]>]

Stefan Santesson wrote:
> I would prefer that we stick to the current draft (FNV) as it is more than
> good enough, free, fast, easy to implement, provides interop and
effectively
> avoids all requirements for agility complexity.

I agree. It is good to see the syntax was simplified as a result.

I have some suggestions:

* The draft says that CachedInformation.cached_info can be up to (2^16-1)*9
= 590KB in size. extension_data can't be larger than 64KB, so the max bound
for the CachedInformation.cached_info array must be 7281 or less. But,
really, sending more than a few hashes per type of cached info is likely to
run into DoS countermeasures. It would be better to have the specification
require and/or at least recommend that there not be more than one (or at
most a few) hashes per information type in the client hello.

* The draft says "An empty cached_information extension indicates that the
server supports information caching but provides no information about what
information types it supports." This is not really helpful. It would be
better to make a non-empty server cached_information extension a
SHOULD-level requirement, because it is very helpful for clients to know
what they should cache, and what they shouldn't.

* The draft says "A present non-empty digest_value indicates that the server
will honor caching of objects of the specified type that matches the present
digest value." I don't see why this is necessary. The server should always
be supporting the digests of the values that it most recently returned, for
the information items it claims to support, so the semantics for empty
digest_values in the server extension are good enough. And, this would let
you simplify the syntax to:

     struct {
           CachedInformationType type;
           opaque digest_value<8>;		<-- always 8 octets
      } CachedObject;

      struct {
           CachedObject cached_info<1..2^16-1>;
      } ClientCachedInformation;     

     struct {
           CachedInformationType cached_info<0..255>;
      } ServerCachedInformation;

Regards,
Brian