Re: [TLS] New draft: draft-rescorla-tls13-new-flows-01

[Eric Rescorla <[e-mail]>]

On Fri, Feb 21, 2014 at 6:46 AM, Nikos Mavrogiannopoulos <[e-mail]>wrote:

> On Wed, 2014-02-19 at 12:40 -0800, Eric Rescorla wrote:
> > Folks,
> > I have prepared a new version of the TLS 1.3 flows document which
> > should appear in the repository shortly and in the meantime can be
> > found at:
>
> Hello,
>  I haven't read it yet to comment, but may I suggest something
> procedural? I think it would be better to first agree on the list of
> issues that TLS 1.3 will fix, and the list of features it will bring,
> and the security requirements for this protocol; as the charter is very
> high level for that.
>
> I believe you have already done that as part of your presentation in
> IETF 88, and there was some discussions on the list some time ago, but I
> don't know what was considered or discarded. It would be nice to have a
> draft that sets the desired requirements for TLS 1.3. (I'd volunteer
> maintain one if that is the issue)
>
> Then it will be much more easy to check whether a proposed solution
> satisfies the requirements, and input from other unrelated groups such
> as CFRG would be more easy to get.
>

I'm certainly sympathetic to this, but I don't think it's really practical
to do detailed requirements first. That's always a hard approach in
IETF, but it's especially hard here because there are a lot of tradeoffs
to be made in terms of feature set and once you get beyond the
trivial mandatory elements it's hard to make them without
understanding the implications of opting to include or not include
any given features without understanding the effect they have on
the protocol in some detail. So, instead we've been doing this
as a cyclical design process, with the charter as the very high
level goals and then trying to work downward.

After Vancouver, I had a lot of feedback to the effect that we
needed to work out the mechanisms more so that people could
make an informed decision, so that's what I've tried to do here.
What I'm hoping we can do in London is to use these more worked
out mechanisms to reach informed decisions on a number of the
big requirements questions (static RSA, encrypted SNI, resumption,
etc.) and then we can work on a refined design that matches
those requirements.

-Ekr


regards,
> Nikos
>
> PS. As I believe that security protocol design is part of cryptography,
> I'm still of the opinion that we should more actively seek for external
> expertise (e.g., by a competition or other appropriate methods).
>