Re: [TLS] Draft Agenda for TLS Interim meeting

[Watson Ladd <[e-mail]>]

On Thu, May 1, 2014 at 11:29 AM, Joseph Salowey (jsalowey)
<[e-mail]> wrote:
> Draft agenda is posted at http://www.ietf.org/proceedings/interim/2014/05/15/tls/agenda/agenda-interim-2014-tls-1 and copied below:
>
> TLS Working Group Interim Meeting
> Dates/Times:
> 15 May 2014 (9:00 am - 5:00 pm MDT)
> 16 May 2014 (9:00 am - 2:00 pm MDT)
> Location:
> 1899 Wynkoop Street, Suite 600, Denver, CO, USA
>
>
> Day 1
> -----------------
> 9:00. Get Settled, Administrivia, Agenda (30 min)
> 9:30 - 10:30  Fixing Session Resumption (Triple Handshake) (60 Min)
> 10:30 - 12:30 Encrypt SNI or not (120 min)
> 12:30 - 1:30 Lunch
> 1:30 - 2:00  Wrap up SNI discussion
> 2:00 - 3:00  Client Puzzles
> 3:00 - 5:00  Discuss Handshake Flows
>
> Day 2
> --------------
> 9:00 Arrival
> 9:30 - 12:30 Discuss Handshake Flows
> 12:30 - 1:00  Wrap up Handshake discussion
> 1:00 - 2:00  Summary and next steps

So I unfortunately won't be at the meeting. I do wonder about the
scope: are Session Resumption fixes and Client Puzzles for TLS 1.2 and
prior, or only TLS 1.3? If we are discussing them in the context of
TLS 1.3 then session resumption fixes aren't really a good idea,
depending on how much you want to break.

If you want to break backwards compatibility, then you take a
known-good key exchange and use that. If TLS 1.3 is really TLS 1.2.1:
that is TLS 1.2 with some new extensions added and some options
removed, then patching makes some sense. However, I don't understand
how patching a protocol when you can do a real fix is a good idea, and
so why discuss a particular attack, when you can rule them all out by
making a few simple changes?

(There are good arguments on both sides. Encrypting SNI is likely to
be a break of compatibility, as is Finished changes for analysis
improvements, and cleaning the protocol in general. But breaking
compatibility will slow adoption, and at this point we need
significant adoption of fixes to TLS and workarounds to security
issues. We've also got the general "well, what you really do isn't in
the spec" problem, which makes it difficult to see what's going on)

Sincerely,
Watson Ladd