Re: [TLS] [CHANNEL-BINDING] RESOLVED (Re: [sasl] lasgt call comments (st Call: draft-altman-tls-channel-bindings (Channel Bindings for TLS) to Proposed Standard))

Nicolas Williams <> Wed, 04 November 2009 19:16 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id ADAEE3A67D1; Wed, 4 Nov 2009 11:16:37 -0800 (PST)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -6.045
X-Spam-Status: No, score=-6.045 tagged_above=-999 required=5 tests=[AWL=0.001, BAYES_00=-2.599, HELO_MISMATCH_COM=0.553, RCVD_IN_DNSWL_MED=-4]
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id Da+PqbqLExUY; Wed, 4 Nov 2009 11:16:37 -0800 (PST)
Received: from (brmea-mail-1.Sun.COM []) by (Postfix) with ESMTP id CF8C73A68C1; Wed, 4 Nov 2009 11:16:36 -0800 (PST)
Received: from ([]) by (8.13.6+Sun/8.12.9) with ESMTP id nA4JGwpH005532; Wed, 4 Nov 2009 19:16:58 GMT
Received: from binky.Central.Sun.COM (binky.Central.Sun.COM []) by (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id nA4JGwMA037327; Wed, 4 Nov 2009 12:16:58 -0700 (MST)
Received: from binky.Central.Sun.COM (localhost []) by binky.Central.Sun.COM (8.14.3+Sun/8.14.3) with ESMTP id nA4J5R1p008329; Wed, 4 Nov 2009 13:05:27 -0600 (CST)
Received: (from nw141292@localhost) by binky.Central.Sun.COM (8.14.3+Sun/8.14.3/Submit) id nA4J5RLb008328; Wed, 4 Nov 2009 13:05:27 -0600 (CST)
X-Authentication-Warning: binky.Central.Sun.COM: nw141292 set sender to using -f
Date: Wed, 04 Nov 2009 13:05:27 -0600
From: Nicolas Williams <>
To: Sam Hartman <>
Message-ID: <20091104190526.GB1105@Sun.COM>
References: <> <> <20091030223647.GO1105@Sun.COM> <> <> <20091104182704.GA1105@Sun.COM> <>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Disposition: inline
In-Reply-To: <>
User-Agent: Mutt/1.5.7i
Subject: Re: [TLS] [CHANNEL-BINDING] RESOLVED (Re: [sasl] lasgt call comments (st Call: draft-altman-tls-channel-bindings (Channel Bindings for TLS) to Proposed Standard))
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Wed, 04 Nov 2009 19:16:37 -0000

On Wed, Nov 04, 2009 at 02:00:20PM -0500, Sam Hartman wrote:
> >>>>> "Nicolas" == Nicolas Williams <> writes:
>     Nicolas> On Wed, Nov 04, 2009 at 10:24:29AM -0800, Michael D'Errico wrote:
>     >> I don't pretend to know exactly what this feature is supposed
>     >> to do, but I think using the word "connection" would be a
>     >> mistake given its widespread use meaning TCP connections, etc.
>     Nicolas> At least the word 'connection' is used in RFC5246 _some_
>     Nicolas> times to mean what we were using it to mean here.
> Sanity check here: For the most part, there is a one-to-one mapping
> between what we're talking about and TCP connections, right?  In

For the most part, yes.

> particular, for most applications, even applications with multiple
> finish messages, grabbing the first finish message from a TCP
> connection gives exactly the one we want.  Am I correctly
> understanding our goal?


> If so, this sounds fairly pedantic.  Pedantic is not bad--we should
> get it to be correct.  However for most app developers, it seems that
> if they assume connection means tcp connection, the right thing will
> happen.  If that's not true, then we have a lot of explaining to do,
> because if I'm confused, then this is a hard problem to explain.

You're not confused.  I fully agree that we've gotten pedantic here.
I don't really understand how anyone could have thought that the channel
binding needed to be communicated to TCP, and thence to the application,
but that's how we got to this point.  Now that we're here, I think we
might as well consider whether we want to have extra rigorous text, or
whether we approve the document as is.