Re: [TLS] PR#28: Converting cTLS to QUIC-style varints

[Michael D'Errico <[e-mail]>]

>>     But if the spec says MUST be minimum length,
>      I would feel compelled to check every one.
>
> "Be liberal in what you accept" no?

A requirement of MUST in a security protocol usually
means (or at least should mean) that there's a good
reason for the thing, whatever it is, so if you are
not checking it, then bad things can happen.  I try
to heed Postel's advice though, and can sometimes be
more liberal than the spec says if I really know
what the trade-offs are.  With crypto though, I don't
pretend to be expert in it, I'm kind of afraid of it,
and I'm not sure how anyone can claim to understand
it well enough to say, for example, that ECC is so
much better than everything else.  What if it's all
broken?  We're getting rid of everything else that
we know works....

>>     Please don't require minimum length unless
>      security would be weaker without it.
>
> If the fields are used in digests/hashing/signatures, then it matters.  (The DER/BER comment upthread)

It matters in X.509 certificates because the basic
encoding rules (BER) allow you to specify the same
thing in different ways.  With DER, there is only
one way to encode every element, so everybody will
come up with the same string of bytes and hashes of
those strings will be the same, signatures will
verify, etc.

I haven't read whatever spec cTLS is, but know that
if I decided to implement it someday and there's a
"varints MUST be minimum length" requirement, I'd
assume that it's important and would check for it.
If this is a waste of CPU cycles, then please don't
make it a requirement.

Mike