Re: [TLS] WGLC for draft-ietf-tls-cross-sni-resumption

Ryan Sleevi <> Mon, 19 July 2021 15:22 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 041A33A3756 for <>; Mon, 19 Jul 2021 08:22:07 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -1.644
X-Spam-Status: No, score=-1.644 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FREEMAIL_FORGED_FROMDOMAIN=0.249, FREEMAIL_FROM=0.001, HEADER_FROM_DIFFERENT_DOMAINS=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_BLOCKED=0.001, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id DARUKrlwT8HZ for <>; Mon, 19 Jul 2021 08:22:02 -0700 (PDT)
Received: from ( []) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by (Postfix) with ESMTPS id 01FF23A3754 for <>; Mon, 19 Jul 2021 08:21:56 -0700 (PDT)
Received: by with SMTP id o4so14702499pgs.6 for <>; Mon, 19 Jul 2021 08:21:56 -0700 (PDT)
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=Kn/qSazfr0CzsaWNRejH2daTRe48ez4lU1NIGy3xQr8=; b=AhA7/qike7Hr4UUlcZlAD40c8+Mfl4a+arEe6Ra1hHqR5OJ3VovpGNCY5xDCiObKTA NWrcb+pNn4G2/jrf1KX0rb7MmUtyjSzcCBjWLkd6aHB0t7cRA+kxjxutVRusIF52KWiM D9GUrLODwiIen8FkXE4lhN/EVBIa+QSBS3yYKi7YeMdsjHKquON5sNZ+wCTcqK6sP6iV TyRSAmh6UT5645iDGPAlGdyNi+Ca5nO8QfVeNb8/zZFKZ6g+a1xewtv2JiO5MXr7qwrP CKAk0mpi61tROVpxs3KCmHn6dL6OZW70VHxhyzVqxwfv7SLRbnQEChVZvMGWNHAt1SMn gwHg==
X-Gm-Message-State: AOAM530HEXPD8Jp/dvjmZbpYQz5LdNePGiR99sNNSKGNuVX4dkTBVKHV LQVYyiwI/0Br5fzpJ8OvnQ9SUw0eZb0=
X-Google-Smtp-Source: ABdhPJwbKi407JsT0OF+mlr5viemn07DLs3FCgkwEO3ejkqfUy2UHYF2VkBJCR+UWWJ4Ql/JpuLWww==
X-Received: by 2002:a63:e303:: with SMTP id f3mr26349046pgh.182.1626708115055; Mon, 19 Jul 2021 08:21:55 -0700 (PDT)
Received: from ( []) by with ESMTPSA id a4sm16573643pfk.5.2021. for <> (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Mon, 19 Jul 2021 08:21:54 -0700 (PDT)
Received: by with SMTP id cu14so11673917pjb.0 for <>; Mon, 19 Jul 2021 08:21:54 -0700 (PDT)
X-Received: by 2002:a17:902:c214:b029:12b:32c5:2ab0 with SMTP id 20-20020a170902c214b029012b32c52ab0mr20018882pll.29.1626708114704; Mon, 19 Jul 2021 08:21:54 -0700 (PDT)
MIME-Version: 1.0
References: <> <> <>
In-Reply-To: <>
From: Ryan Sleevi <>
Date: Mon, 19 Jul 2021 11:21:43 -0400
X-Gmail-Original-Message-ID: <>
Message-ID: <>
To: Stephen Farrell <>
Cc: "Salz, Rich" <>, Christopher Wood <>, "" <>
Content-Type: multipart/alternative; boundary="000000000000548f2a05c77b7f1c"
Archived-At: <>
Subject: Re: [TLS] WGLC for draft-ietf-tls-cross-sni-resumption
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Mon, 19 Jul 2021 15:22:07 -0000

On Mon, Jul 19, 2021 at 11:02 AM Stephen Farrell <>

> I don't find the reference to [FETCH] explains how that
> problem can be mitigated by browsers. (IIRC, adding that
> was the result of earlier discussion of this point?)

I'm not sure I'm parsing this correctly.

Are you saying that you don't believe network isolation keys are
sufficient? That is, this is the current language from the draft:

> For example, the Web use case uses network partition keys to separate
cache lookups [FETCH].

And the term there ("network partition keys") is a defined term in the
FETCH spec that forms the basis of cross-domain tracking prevention:

It's unclear whether you're saying that the spec should diverge from FETCH
and impose additional requirements, or whether you're saying you don't
believe the current FETCH spec is robust enough there.

It's unclear that there's any benefit to having the Cross-SNI spec impose
additional requirements: you have to consider the Web application in its
entire context, which is precisely what network partition keys do.
Similarly, if the concern is that FETCH isn't sufficient for your concerns,
is that a concern with this spec, or with FETCH, and can/should they be
articulated there (and the related issue mentioned)


> I think both of those are indicators that this mechanism
> could be used at scale for tracking.

You opened by talking about MTAs, but it's unclear if this is meant to be a
general statement or specific to mail. In the context of the Web, then we
have to consider the holistic platform, and ask whether this hooks into the
same appropriate points - it does, as the partition keys are based on the
same cross-origin tracking protection mechanisms (e.g. the determination of
"first party" vs "third party" contexts is implicitly handled here). If
this is for mail, then isn't the point that this remains an
application-/protocol-specific consideration?