IETF Logo Mail Archive

Re: [TLS] Encrypting record headers: practical for TLS 1.3 after all?

Bryan A Ford <brynosaurus@gmail.com> Thu, 03 December 2015 09:35 UTC

Return-Path: <brynosaurus@gmail.com>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BA22E1ACE18 for <tls@ietfa.amsl.com>; Thu, 3 Dec 2015 01:35:33 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2
X-Spam-Level:
X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id S28FMqFAXGvp for <tls@ietfa.amsl.com>; Thu, 3 Dec 2015 01:35:30 -0800 (PST)
Received: from mail-wm0-x22d.google.com (mail-wm0-x22d.google.com [IPv6:2a00:1450:400c:c09::22d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9958B1A1BE4 for <tls@ietf.org>; Thu, 3 Dec 2015 01:35:29 -0800 (PST)
Received: by wmww144 with SMTP id w144so13876615wmw.0 for <tls@ietf.org>; Thu, 03 Dec 2015 01:35:28 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=subject:to:references:from:message-id:date:user-agent:mime-version :in-reply-to:content-type; bh=IiRuNABfIAHPIbuVAduwbojcsE8Uzk4YrSW5TvZ/lrE=; b=SMJk0AHVfa2CoxSPHHMT/Hf5EP6dXbJqiXpwz+zBKwC+BEam3GjGMOH09jIIZlEa1M +xk8+XuLuaZsJxt8hIk8HjiS9jnDgMRU6k3Y5wFae774F+ub2vQRGuVGG6H1eFXhss/W v954cXrdEADuZIGrvv9RDK13mjpz+CZUy6TLl1JKUoZaujadqMTEu44AjvMqwvAUSPIo PaTBFPsN95XmvkWRc9ECbxeoj9Pp+I6cUO143xIWZueY1DQyw6NmX28DceD9kDNefS+l cJ6g6oj41LBUnyg33KU46axK246AZFojfRDFZH3woRYNbpwHDelw8axXe4otRVoRPy+L Ehzw==
X-Received: by 10.194.62.14 with SMTP id u14mr10153253wjr.24.1449135328229; Thu, 03 Dec 2015 01:35:28 -0800 (PST)
Received: from tsf-476-wpa-0-180.epfl.ch (tsf-476-wpa-0-180.epfl.ch. [128.179.176.180]) by smtp.gmail.com with ESMTPSA id kb5sm6661440wjc.20.2015.12.03.01.35.26 for <tls@ietf.org> (version=TLSv1/SSLv3 cipher=OTHER); Thu, 03 Dec 2015 01:35:27 -0800 (PST)
To: tls@ietf.org
References: <56586A2F.1070703@gmail.com> <9A043F3CF02CD34C8E74AC1594475C73F4B8DA2A@uxcn10-5.UoA.auckland.ac.nz> <565AC278.2010904@gmail.com> <9A043F3CF02CD34C8E74AC1594475C73F4B92E74@uxcn10-5.UoA.auckland.ac.nz> <565C0F25.7000507@gmail.com> <9A043F3CF02CD34C8E74AC1594475C73F4B9331B@uxcn10-5.UoA.auckland.ac.nz> <20151201005609.GD18315@mournblade.imrryr.org> <CAFggDF03fzyAw95Ka8NHtBGEcebAe3RCt5pRd3r8_nhBbR7oNw@mail.gmail.com> <3B906BDF-CA30-4EDF-ADA9-ABFC2A25014D@gmail.com> <CAFggDF2sWLr-2yXPDrznymO_E1Zx_UCm1zn92J8O84WZh2gMrA@mail.gmail.com> <A4341585-0020-4F8B-84CC-BBC0EE7F57CB@gmail.com> <CAFggDF2Mvmqc7RifSYf7Q=tJdK7oWipUQjwK=GmhgB-rvZCqdA@mail.gmail.com> <FC4B4A5A-3D42-411B-AFF9-2381DE61E63E@gmail.com> <CFCAB19C-9040-4FB0-B774-3A0C3E5EF9B9@lamsap.org>
From: Bryan A Ford <brynosaurus@gmail.com>
Message-ID: <56600CE2.2060807@gmail.com>
Date: Thu, 03 Dec 2015 10:35:30 +0100
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:38.0) Gecko/20100101 Thunderbird/38.3.0
MIME-Version: 1.0
In-Reply-To: <CFCAB19C-9040-4FB0-B774-3A0C3E5EF9B9@lamsap.org>
Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg="sha-256"; boundary="------------ms040805010304000306030900"
Archived-At: <http://mailarchive.ietf.org/arch/msg/tls/LAUqjCDcRqAAD4I3NkQ8PXvyXUE>
Subject: Re: [TLS] Encrypting record headers: practical for TLS 1.3 after all?
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 03 Dec 2015 09:35:33 -0000

Hi Mike,

On 12/2/15 4:14 PM, Mike Copley wrote:
> [...] Not sure if this is the right place to consider, but would DTLS 1.3(?) be able to encrypt headers and still handle packet loss and re-ordering? If DTLS needs cleartext headers, would it be better to advise one approach for both protocols?

Please see the other recent E-mails in this discussion thread
specifically addressing how my first proposal extends to DTLS.  My
second proposed approach to header encryption is admittedly more
TCP-specific, and that might be one legitimate reason to prefer the
first one if we care about keeping TLS and DTLS as closely-aligned as
possible.

B

> 
> Regards,
> 
> Mike Copley
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls
>

v2.23.0 | Report a Bug | By Email