Re: [TLS] Finished stuffing/PSK Binders
Eric Rescorla <ekr@rtfm.com> Fri, 07 October 2016 20:42 UTC
Return-Path: <ekr@rtfm.com>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2301D12940F for <tls@ietfa.amsl.com>; Fri, 7 Oct 2016 13:42:41 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.599
X-Spam-Level:
X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0zJUlEj0-Brx for <tls@ietfa.amsl.com>; Fri, 7 Oct 2016 13:42:36 -0700 (PDT)
Received: from mail-yw0-x22e.google.com (mail-yw0-x22e.google.com [IPv6:2607:f8b0:4002:c05::22e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AFF97129547 for <tls@ietf.org>; Fri, 7 Oct 2016 13:42:29 -0700 (PDT)
Received: by mail-yw0-x22e.google.com with SMTP id w3so11959804ywg.1 for <tls@ietf.org>; Fri, 07 Oct 2016 13:42:29 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=g5fgoMpg5hKO0YQFCTArDLYeXCEMSvCD45Y7Yy85IEE=; b=1RC+s+0wBq6TFYJlLVAD7MG590Lecf+t7Oa8bNtxaKrKtGh4PSnkhFBVFRwa67eSrl Z96i4oudeWSpAlyGm1lLSPEdyqZZNRiX/EFU7ukljCD6l+XA/0Cf/8cxsPAaKEME0qNz YyPzmETDouSoA/nGStwmaWK4JfFhGp3WiNU3Xz0STNz6yd8zGCadJbM00FG9sluxcWEo nQHWiNgTVmyu6VVFPYsHS7wgOP6VwwcwJs9ZgYe36WvubyTpPtPFpdFOLtDX2+oA5BbP Kmi0Ddx4H2zEBgf5dY4IVzz457EJJto8mmBPDJ3dOMpwm4o0OjEOsra+4njggbmaZGl/ TFJg==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=g5fgoMpg5hKO0YQFCTArDLYeXCEMSvCD45Y7Yy85IEE=; b=gXAiRivIgJyX9CdAOA5g44JgpxvGbemzRAZ/MKAadCFsIfQ8Xi8kC/FmtiiaxxlqN8 RMKMx0hkD/qg7FnPLoF+1QC0Mob4gWqPCktxIAHkRgXeCatzFMsFzeBh+NqBLzXkCsCy Iu5TqL8dhi/VmX3VNSz/JjaYT+CgmPDCsXavdagS9Fkr5wtjFa/CtVvEjiIiNftHxTQq Vfk9xzKCurI4gSkR0RHpmk+UCQGsfIAjcJ+ofS7eSxGrOMSigmdSLiQQg0XW7haHtbMY z1/EEtsXNL3dzMD9j8er0ttH0LDLGUQNnmU7IOWxE8NwLTezsE6Ny3Vm0P0JNbLsulim KEfQ==
X-Gm-Message-State: AA6/9RleF8ZTgczcXZXfmDJTCj4392xTnZaP2qGx031I1M0+lh2ds3f0Gq+MPLI3Ct32bkkRT2k0dxtZEacTbw==
X-Received: by 10.129.125.198 with SMTP id y189mr16249536ywc.234.1475872948992; Fri, 07 Oct 2016 13:42:28 -0700 (PDT)
MIME-Version: 1.0
Received: by 10.129.75.212 with HTTP; Fri, 7 Oct 2016 13:41:48 -0700 (PDT)
In-Reply-To: <c405a571-3a49-e0bc-bd21-bae469334f9a@akamai.com>
References: <CABcZeBOJPz8DY92LE6531xbRYLU-Wvkqeb-vTX59gU5rYcp+Ww@mail.gmail.com> <20161007152628.GA9408@LK-Perkele-V2.elisa-laajakaista.fi> <CABcZeBO5HEJAm=QO2NjEWHAH_mKBUBoPn0=Zw5mtKmVz9SP=wQ@mail.gmail.com> <20161007170323.GA9856@LK-Perkele-V2.elisa-laajakaista.fi> <CABcZeBNp6wjxHBQ+io2Pcwd364=iiobKp-UHZZxOYZbmR7X7AQ@mail.gmail.com> <c405a571-3a49-e0bc-bd21-bae469334f9a@akamai.com>
From: Eric Rescorla <ekr@rtfm.com>
Date: Fri, 07 Oct 2016 13:41:48 -0700
Message-ID: <CABcZeBNuZC3tjuFNSqiQba1yRrOEtYSgYCo5oECzvWDRVfd=Mw@mail.gmail.com>
To: Benjamin Kaduk <bkaduk@akamai.com>
Content-Type: multipart/alternative; boundary="001a114926a0dbf387053e4c72a6"
Archived-At: <https://mailarchive.ietf.org/arch/msg/tls/JqqlF4FhULAUIaU4VAMqoepoM8k>
Cc: "tls@ietf.org" <tls@ietf.org>
Subject: Re: [TLS] Finished stuffing/PSK Binders
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.17
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 07 Oct 2016 20:42:41 -0000
On Fri, Oct 7, 2016 at 1:39 PM, Benjamin Kaduk <bkaduk@akamai.com> wrote: > On 10/07/2016 12:08 PM, Eric Rescorla wrote: > > > > On Fri, Oct 7, 2016 at 10:03 AM, Ilari Liusvaara <ilariliusvaara@welho.com > > wrote: > >> On Fri, Oct 07, 2016 at 09:35:40AM -0700, Eric Rescorla wrote: >> > On Fri, Oct 7, 2016 at 8:26 AM, Ilari Liusvaara < >> ilariliusvaara@welho.com> >> > wrote: >> > >> > > On Fri, Oct 07, 2016 at 08:01:43AM -0700, Eric Rescorla wrote: >> > > > 4. I've taken a suggestion from David Benjamin to move the >> negotiation >> > > > of the PSK key exchange parameters out of the PSK itself and into a >> > > > separate message. This cleans things up and also lets us drop the >> > > > currently non-useful auth_mode parameter. >> > > >> > > Eeh... From the text, it seems to currently require the kex modes >> > > extension if PSK extension is present. Which seems worse than useless >> > > if the meaning is to get rid of the kex mode parameter from PSK >> > > extension (since you will have the value anyway, but need to dig it >> > > from another extension... Blech). >> > >> > I guess this is a matter of taste, but what convinced me was that: >> > >> > 1. It put all the logic on the server side. >> > > I was going to ask whether this also includes the decision on whether to > send a Certificate to authenticate the server (even for PSK modes), but it > looks like this change is intentionally removing the ability to do PSK > keyex and auth with a certificate? > Yes, while preserving the ability to add it later by adding a PskAuthMode extension parallel to this one. -Ekr > > 2. It removed the auth mod parameter. >> > >> > Maybe david can say more. >> >> I mean if server is to accept PSK, it must now go fishing for another >> extension, check that it is present and pay attention to values there. >> As opposed to having the data in where it is needed. >> > > This is a reasonable argument (and the reason I stuffed the binder here). > However, David's argument was that this applied to *all* PSKs even new > ones. > > > Implementations already have to do some amount of "scan through all > extensions to detect certain things, do some initial processing, and then > finish process everything [else]", not least because SNI can change what > cert types you have, configuration knobs, etc.. So, yes it's bad, but how > bad is it in a relative sense? > > I think there is some value in the client indicating to the server whether > it doesn't want to do psk_dhe (or doesn't want to do pure psk) for future > NSTs, though it's perhaps not of the utmost importance. That property does > support a separate psk_key_exchange_modes extension in preference to > rolling it into pre_shared_keys (as a separate list next to identities and > binders), but it seems to only be a weak argument for separation. I do > think that keeping the psk kex mode orthogonal to the individual keys is > helpful, though. > > Anyway, maybe it's time to bite the bullet and actually write up the > description of the proper procedure for ClientHello processing (scan > extensions for SNI, load up servername-specific config+cert/key, etc.). > Which would make this stuff any prettier, but would at least help people > not get it wrong. > > -Ben >
- [TLS] Finished stuffing/PSK Binders Eric Rescorla
- Re: [TLS] Finished stuffing/PSK Binders Ilari Liusvaara
- Re: [TLS] Finished stuffing/PSK Binders Eric Rescorla
- Re: [TLS] Finished stuffing/PSK Binders Ilari Liusvaara
- Re: [TLS] Finished stuffing/PSK Binders Eric Rescorla
- Re: [TLS] Finished stuffing/PSK Binders Benjamin Kaduk
- Re: [TLS] Finished stuffing/PSK Binders Eric Rescorla
- Re: [TLS] Finished stuffing/PSK Binders Ilari Liusvaara
- Re: [TLS] Finished stuffing/PSK Binders Ilari Liusvaara
- Re: [TLS] Finished stuffing/PSK Binders Eric Rescorla
- Re: [TLS] Finished stuffing/PSK Binders Ilari Liusvaara
- Re: [TLS] Finished stuffing/PSK Binders Eric Rescorla
- Re: [TLS] Finished stuffing/PSK Binders Hugo Krawczyk
- Re: [TLS] Finished stuffing/PSK Binders Eric Rescorla
- Re: [TLS] Finished stuffing/PSK Binders Martin Thomson
- Re: [TLS] Finished stuffing/PSK Binders Eric Rescorla
- Re: [TLS] Finished stuffing/PSK Binders Ilari Liusvaara
- Re: [TLS] Finished stuffing/PSK Binders Martin Thomson
- Re: [TLS] Finished stuffing/PSK Binders Ilari Liusvaara
- Re: [TLS] Finished stuffing/PSK Binders Benjamin Kaduk
- Re: [TLS] Finished stuffing/PSK Binders Ilari Liusvaara