Re: [TLS] New draft: draft-rescorla-tls13-new-flows-01

[Kurt Roeckx <[e-mail]>]

On Wed, Feb 19, 2014 at 12:40:38PM -0800, Eric Rescorla wrote:
> Folks,
> 
> I have prepared a new version of the TLS 1.3 flows document which
> should appear in the repository shortly and in the meantime can be
> found at:
> 
> https://github.com/tlswg/tls13-spec/blob/master/draft-rescorla-tls-1.3.txt
> 
> This version fleshes out a "recommended" set of flows:
> 
> - 2-RTT where the client has no knowledge of the
>   server's capabilities.
> 
> - 1-RTT where the client knows the server's semi-permanent
>   DHE/ECDHE key pair.
> 
> - 0-RTT where the client and the server have shared anti-replay
>   state.

So reading this, one of the points I see if that you could
distribute this semi-permanent DHE/ECDHE key pair via DNS for
instance.  I think that the presence of that information
in DNS could indicate that the server does support it and I
currently don't see why:
- You can't do 0-RTT
- SNI needs common crypto parameters

The only reason I can find in your document is to prevent replay,
but I currently don't see how this is a problem.

I'd also like to point out that you might be leaking the site
you're connecting to via DNS.


Kurt