IETF Logo Mail Archive

Re: [TLS] Revised TLS Charter

Nikos Mavrogiannopoulos <nmav@gnutls.org> Tue, 24 May 2011 06:49 UTC

Return-Path: <n.mavrogiannopoulos@gmail.com>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2DE6CE06CE for <tls@ietfa.amsl.com>; Mon, 23 May 2011 23:49:59 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.977
X-Spam-Level:
X-Spam-Status: No, score=-2.977 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2huIFVE0cRRL for <tls@ietfa.amsl.com>; Mon, 23 May 2011 23:49:58 -0700 (PDT)
Received: from mail-px0-f179.google.com (mail-px0-f179.google.com [209.85.212.179]) by ietfa.amsl.com (Postfix) with ESMTP id 97098E0662 for <tls@ietf.org>; Mon, 23 May 2011 23:49:58 -0700 (PDT)
Received: by pxi2 with SMTP id 2so3813104pxi.38 for <tls@ietf.org>; Mon, 23 May 2011 23:49:58 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:sender:in-reply-to:references:date :x-google-sender-auth:message-id:subject:from:to:cc:content-type :content-transfer-encoding; bh=yX+cohlyd3QWuxCE19jCgGeq0nS8kqvKwBdiTCTfNOI=; b=U/00E35kMgDyXlMIUpTGZd17kPkf0EtbpN20SymXRoO+emCssi7aDbumeCFnNnwEXJ izxZMjaSP5b2Xxy+j5rM7SowxJlaUNcj+F1f+sUDRNNHXhhQSDTV92vbEHGv+IG5+/oQ mH4rnJ5YFQMgGXrK2dyfS/4aVfBI86eqepm50=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:sender:in-reply-to:references:date :x-google-sender-auth:message-id:subject:from:to:cc:content-type :content-transfer-encoding; b=ljfWCIvYzWNi+WJ30b4fP2W192qo3OQEzKleEpGen8iS2f+CqLmXSjOektPNT+zvhP lfeM5rk0prGJGfHgLLrAFu0dWWQ5WWc35YGf+NmxB1tOumfAyhmvtRgwV9wmK8FTgOjW CtwG5Mr2QoHciTxV6Dx0p2EiP2IT7yuvUNyBM=
MIME-Version: 1.0
Received: by 10.142.215.18 with SMTP id n18mr980524wfg.332.1306219798201; Mon, 23 May 2011 23:49:58 -0700 (PDT)
Sender: n.mavrogiannopoulos@gmail.com
Received: by 10.142.245.11 with HTTP; Mon, 23 May 2011 23:49:58 -0700 (PDT)
In-Reply-To: <618342307.5601.1306190776733.JavaMail.root@zimbra1.shared.sjc1.mozilla.com>
References: <BANLkTik==6bPmARJRBJwsLo_wegFMjC4BQ@mail.gmail.com> <618342307.5601.1306190776733.JavaMail.root@zimbra1.shared.sjc1.mozilla.com>
Date: Tue, 24 May 2011 08:49:58 +0200
X-Google-Sender-Auth: mOvHkv91PHyekkUmb7spCFInhLQ
Message-ID: <BANLkTik0QD22qgouHtmHOkhSXMyfsKexmg@mail.gmail.com>
From: Nikos Mavrogiannopoulos <nmav@gnutls.org>
To: Brian Smith <bsmith@mozilla.com>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Cc: tls@ietf.org
Subject: Re: [TLS] Revised TLS Charter
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/tls>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 24 May 2011 06:49:59 -0000

On Tue, May 24, 2011 at 12:46 AM, Brian Smith <bsmith@mozilla.com> wrote:

> We may also implement the current TLS False Start mechanism, but I think it would be better to have an opt-in one-round-trip handshake mechanism. Such a mechanism would probably involve the client optimistically putting a ClientKeyExchange (probably formatted like a ServerKeyExchange) message in a ClientHello extension, so that the server can send its ChangeCipherSuite and Finished messages immediately after its ServerHelloDone message.

Kerberos PKINIT does something similar to that. I found few attacks on
that approach when using smart-cards:
http://old.nabble.com/-Ietf-krb-wg--PKINIT-with-smart-cards-td31578223.html

Being conservative in design (as TLS does) pays off.

regards,
Nikos

v2.23.0 | Report a Bug | By Email