Re: [TLS] WGLC for draft-ietf-tls-ticketrequests

Viktor Dukhovni <> Wed, 20 November 2019 06:48 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id B181C120255 for <>; Tue, 19 Nov 2019 22:48:22 -0800 (PST)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -4.2
X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id MubXEcPq4qLo for <>; Tue, 19 Nov 2019 22:48:21 -0800 (PST)
Received: from ( []) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by (Postfix) with ESMTPS id 02768120125 for <>; Tue, 19 Nov 2019 22:48:20 -0800 (PST)
Received: by (Postfix, from userid 1001) id 416AC331BB8; Wed, 20 Nov 2019 01:48:19 -0500 (EST)
Date: Wed, 20 Nov 2019 01:48:19 -0500
From: Viktor Dukhovni <>
Message-ID: <>
References: <> <> <> <> <> <> <> <> <> <>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <>
User-Agent: Mutt/1.12.1 (2019-06-15)
Archived-At: <>
Subject: Re: [TLS] WGLC for draft-ietf-tls-ticketrequests
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Wed, 20 Nov 2019 06:48:23 -0000

On Wed, Nov 20, 2019 at 11:53:08AM +0800, Tommy Pauly wrote:

> > Somebody should try to avoid ending up with N new tickets after
> > every connection, but in could well be the client.
> Yes, I think that can and ought to be the client. The client is really the
> only party that can know how many tickets have been "consumed" by potentially
> failed attempts to connect that the server didn't see in time or got dropped.

OK, in that case, the proposal, is that on resumption, if the proposed
extension is *absent*, then the server should generally send just one rather
than any larger default.

If the extension is present, it is up to the client to not blindly ask for N
tickets each time, and generally ask for just one ticket on resumption, once it
has sufficiently many tickets for the desired concurrency level, with each
parallel thread obtaining one replacement ticket its next connection.

As discussed clients that prefer to reuse tickets, can ask for zero, and get 1
only as-needed.  If the server supports reuse then all is well.

If the server does not support and refuses reuse, then it will issue a new
ticket each time and may only accept it once, but the client may have a
single-slot cache.  If the client makes only one connection at a time, this
also works, but if/when its handshakes with the server overlap (a narrow window
of ~1RTT) and two connections attempt to resume with the same ticket, one of
them will end up doing a full handshake, but only when the client and server
applications have incompatible ticket reuse expectations.  Some friction
when the client and server are mismatched is not the end of the world.

So on the whole I think the proposal still works with just a numeric signal
(tweaked with 0xff == none and 0 == reuse), and the onus to "generally send 1"
on resumption moved to the client (i.e. clients that don't solicit ticket reuse
should request only 1 ticket once they have enough).