IETF Logo Mail Archive

Re: [TLS] Banning implicit CIDs in DTLS

Thomas Fossati <Thomas.Fossati@arm.com> Sun, 24 May 2020 18:00 UTC

Return-Path: <Thomas.Fossati@arm.com>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5D22D3A0C57 for <tls@ietfa.amsl.com>; Sun, 24 May 2020 11:00:55 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.9
X-Spam-Level:
X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001, UNPARSEABLE_RELAY=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=armh.onmicrosoft.com header.b=vZ1tbOBK; dkim=pass (1024-bit key) header.d=armh.onmicrosoft.com header.b=vZ1tbOBK
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0lHNe03dbP7n for <tls@ietfa.amsl.com>; Sun, 24 May 2020 11:00:53 -0700 (PDT)
Received: from EUR05-DB8-obe.outbound.protection.outlook.com (mail-db8eur05on2080.outbound.protection.outlook.com [40.107.20.80]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1B58D3A0C54 for <TLS@ietf.org>; Sun, 24 May 2020 11:00:52 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=armh.onmicrosoft.com; s=selector2-armh-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=BRLIichF+wXFhfcccCUiFtJIzJq4v2y8+3jXs5aFMOU=; b=vZ1tbOBKmOjcJBzOS0X/7rV4v542tkoucfoxkFSfZ9M32mYFOR3VqBcHehjL+2UFo+5OqRYbGHpgXKLKtgo0XwvrsKwoCJ2A3IhtQHgIHoH1yTU0haxGEML5DSBoUjoGKiz5azJrFR7nsBhrZceDa3jtd7BtNLzD/GbXXuur9uc=
Received: from MR2P264CA0076.FRAP264.PROD.OUTLOOK.COM (2603:10a6:500:32::16) by AM5PR0801MB1617.eurprd08.prod.outlook.com (2603:10a6:203:39::11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3021.27; Sun, 24 May 2020 18:00:49 +0000
Received: from VE1EUR03FT004.eop-EUR03.prod.protection.outlook.com (2603:10a6:500:32:cafe::55) by MR2P264CA0076.outlook.office365.com (2603:10a6:500:32::16) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3021.23 via Frontend Transport; Sun, 24 May 2020 18:00:49 +0000
X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 63.35.35.123) smtp.mailfrom=arm.com; ietf.org; dkim=pass (signature was verified) header.d=armh.onmicrosoft.com;ietf.org; dmarc=bestguesspass action=none header.from=arm.com;
Received-SPF: Pass (protection.outlook.com: domain of arm.com designates 63.35.35.123 as permitted sender) receiver=protection.outlook.com; client-ip=63.35.35.123; helo=64aa7808-outbound-1.mta.getcheckrecipient.com;
Received: from 64aa7808-outbound-1.mta.getcheckrecipient.com (63.35.35.123) by VE1EUR03FT004.mail.protection.outlook.com (10.152.18.106) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3021.23 via Frontend Transport; Sun, 24 May 2020 18:00:49 +0000
Received: ("Tessian outbound cff7dd4de28a:v57"); Sun, 24 May 2020 18:00:48 +0000
X-CheckRecipientChecked: true
X-CR-MTA-CID: 4da8dda258f45189
X-CR-MTA-TID: 64aa7808
Received: from ab10d5b45c8d.2 by 64aa7808-outbound-1.mta.getcheckrecipient.com id 5D115298-278D-4D27-8981-8427455E95D5.1; Sun, 24 May 2020 18:00:43 +0000
Received: from EUR05-AM6-obe.outbound.protection.outlook.com by 64aa7808-outbound-1.mta.getcheckrecipient.com with ESMTPS id ab10d5b45c8d.2 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384); Sun, 24 May 2020 18:00:43 +0000
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=E1LyjOHKad1TJOUIbeDlTxv/pO52inOtE057nTZ3yxBFtha9j/YSrdPJbIrJ88EVWdu5O7UHs8oqQVzV9AqKVyU3x20aNdhSkMjT7w+kDOzZPIHD7pn+BCxqCDby+QKDHkWDst6kGmg9rV4eXVQywQdS0P0UP9B6dfQEAshpTuyq1BXDY/jdJgB3i9pqZyppVLl0ron2K+H6YtQMvQpP4af3eQugIf2NI9x4eB01GzICqCHFAhWkEYOGGSHeZ/m9n3j8/mcoFATXqJIQS6VsqYg9oG3ltez6dVb5zJRyfa3X/Gi5/EIR2rwlMJiKR4dBX9wWhXEAhkGkoHu/M1xNMA==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=BRLIichF+wXFhfcccCUiFtJIzJq4v2y8+3jXs5aFMOU=; b=YsQ8Oiluzm1RH8lzxStf/T7N/LOMocXBBqcRiHWWBL6AWPFsziPrtNEOosgEziGa9KqwhxwfdzRD8jJVnUhI7R6ln+ZPcpFe2hvVpG0DgH16hg+vp2hT1ixlRoDAy3hEa3oe943aMkUP9d37UuY35eEvlkPbDqLyiYl5QX7oKor96W+uN0F2VBQ0g/2E/QfuBCpypxOHxXfVYZ8HnDWAJNvbNfsidCaxv2d6RrC9E4ReZwbuwgQNFvzPUHdh/K9VPALzVJ6L9m9URXZhgaCoYPvWMEhh3J+AiZnrvLfOU7zW3VeZAzx5EngQ4vw6qeFLK44cxOcJZ87H7UdzGhmDvA==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=arm.com; dmarc=pass action=none header.from=arm.com; dkim=pass header.d=arm.com; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=armh.onmicrosoft.com; s=selector2-armh-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=BRLIichF+wXFhfcccCUiFtJIzJq4v2y8+3jXs5aFMOU=; b=vZ1tbOBKmOjcJBzOS0X/7rV4v542tkoucfoxkFSfZ9M32mYFOR3VqBcHehjL+2UFo+5OqRYbGHpgXKLKtgo0XwvrsKwoCJ2A3IhtQHgIHoH1yTU0haxGEML5DSBoUjoGKiz5azJrFR7nsBhrZceDa3jtd7BtNLzD/GbXXuur9uc=
Received: from AM6PR08MB4231.eurprd08.prod.outlook.com (2603:10a6:20b:73::23) by AM6PR08MB3544.eurprd08.prod.outlook.com (2603:10a6:20b:4e::30) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3021.27; Sun, 24 May 2020 18:00:42 +0000
Received: from AM6PR08MB4231.eurprd08.prod.outlook.com ([fe80::5e0:a53a:d4d6:2e8d]) by AM6PR08MB4231.eurprd08.prod.outlook.com ([fe80::5e0:a53a:d4d6:2e8d%6]) with mapi id 15.20.3021.029; Sun, 24 May 2020 18:00:42 +0000
From: Thomas Fossati <Thomas.Fossati@arm.com>
To: Christopher Wood <caw@heapingbits.net>, "TLS@ietf.org" <TLS@ietf.org>
Thread-Topic: [TLS] Banning implicit CIDs in DTLS
Thread-Index: AQHWL4jlXax4fI+63EScN0u04f2J/6iyyZ8AgABxsgCABGDagA==
Date: Sun, 24 May 2020 18:00:42 +0000
Message-ID: <780181FE-B9FE-452F-93F4-4268DFB4E47E@arm.com>
References: <df70e06b-ffdf-4402-b640-d99b2aafac6b@www.fastmail.com> <17230F7E-0983-4519-8BA3-50D3F1A66C22@arm.com> <b45dea1f-506a-420e-aa3b-4d6c0fae5028@www.fastmail.com>
In-Reply-To: <b45dea1f-506a-420e-aa3b-4d6c0fae5028@www.fastmail.com>
Accept-Language: en-GB, en-US
Content-Language: en-GB
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
user-agent: Microsoft-MacOutlook/16.37.20051002
Authentication-Results-Original: heapingbits.net; dkim=none (message not signed) header.d=none;heapingbits.net; dmarc=none action=none header.from=arm.com;
x-originating-ip: [82.11.185.80]
x-ms-publictraffictype: Email
X-MS-Office365-Filtering-HT: Tenant
X-MS-Office365-Filtering-Correlation-Id: 251a2609-9598-4fe0-64d8-08d8000c6442
x-ms-traffictypediagnostic: AM6PR08MB3544:|AM5PR0801MB1617:
x-ms-exchange-transport-forked: True
X-Microsoft-Antispam-PRVS: <AM5PR0801MB1617CEFBCE087AF78D31D5149CB20@AM5PR0801MB1617.eurprd08.prod.outlook.com>
x-checkrecipientrouted: true
nodisclaimer: true
x-ms-oob-tlc-oobclassifiers: OLM:8273;OLM:9508;
x-forefront-prvs: 0413C9F1ED
X-MS-Exchange-SenderADCheck: 1
X-Microsoft-Antispam-Untrusted: BCL:0;
X-Microsoft-Antispam-Message-Info-Original: zcAhFSha72sj3SDhiTby+mg2oNq4E3OSZxWQDkLin4wAQm5LBLiTMdUtLEiwiq9OeWlzYEl7sVhZWTxcvZuOSQDS+JiSvORGollf9H98QMdGlHVQFKX2VWK2ifByek/LIzbeUq1841FrGXTDLFvb4yLhx1PuOkzVXf236ZQR/Adi8BkxBp+EvxfxvEV58tqX/i5zbYUozfp73CJ1ROtHH0AgS8UUB3TwyKQnF0k/gjSfbZoLyPzl7wRy6SSd9EuXtO/YVF+vpviXf+zN7+MTo/XukTvHrYTM6QKUeF5gbgNdZW3IaDah7+qWsEjuBg7WvJCnjxy9d26zPGmCgy2keA==
X-Forefront-Antispam-Report-Untrusted: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:AM6PR08MB4231.eurprd08.prod.outlook.com; PTR:; CAT:NONE; SFTY:; SFS:(4636009)(366004)(136003)(396003)(39850400004)(376002)(346002)(33656002)(8676002)(66946007)(76116006)(66556008)(86362001)(8936002)(5660300002)(66446008)(64756008)(91956017)(66476007)(110136005)(4326008)(6512007)(316002)(478600001)(6506007)(53546011)(26005)(2906002)(186003)(36756003)(71200400001)(2616005)(6486002); DIR:OUT; SFP:1101;
x-ms-exchange-antispam-messagedata: nN4vPGBqeFtgqG2fgQyTFFjASvZWRG3q9Pq9VSJDC6VgIk5jK3WAhK/tGDhPJCt8tlqAqmC7pG/6EXWGBkoWnGuPZUGMNX+HDYI1TNDqtborWitgL60t6TXtTsfb000HI9agPD5LxoyprTYjNPyhYYt+LWfGQusgJve0EcFYhwHRBMcI23D6tJ1TKO1mKOSIZy9Z4f9uV5WQ5i0ehcqhvzuCdkQE3fVyzVosQjYXiZJ+48GPOrDVLvIcQ/C0YA4hbf3/Q9EAk3Oba1fgqOGzJJxCDQBkUXtzmu7V91H2/xN6+zD3Djgca9PzlrNj5PkI68nF3TLa9u5yS8my+YlQ7F2XHYjKb+RpnckR2EycawIqz8EloBTtoYRiEk95ZbGPNdLhSRLB970dmElcTZR6KMoIedRqBXq9IMFbx8j0dZV1faKqd7PGAnCpTNPLPC1YuScCppS8JQGUYK9aZFW73PzA0mnBwjlHEFezw1oU44U=
Content-Type: text/plain; charset="utf-8"
Content-ID: <4542F5CCB7B5534EA8A1A3469CD0A0CE@eurprd08.prod.outlook.com>
Content-Transfer-Encoding: base64
MIME-Version: 1.0
X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM6PR08MB3544
Original-Authentication-Results: heapingbits.net; dkim=none (message not signed) header.d=none;heapingbits.net; dmarc=none action=none header.from=arm.com;
X-EOPAttributedMessage: 0
X-MS-Exchange-Transport-CrossTenantHeadersStripped: VE1EUR03FT004.eop-EUR03.prod.protection.outlook.com
X-Forefront-Antispam-Report: CIP:63.35.35.123; CTRY:IE; LANG:en; SCL:1; SRV:; IPV:CAL; SFV:NSPM; H:64aa7808-outbound-1.mta.getcheckrecipient.com; PTR:ec2-63-35-35-123.eu-west-1.compute.amazonaws.com; CAT:NONE; SFTY:; SFS:(4636009)(346002)(376002)(39850400004)(136003)(396003)(46966005)(356005)(316002)(36906005)(6512007)(6486002)(33656002)(5660300002)(110136005)(86362001)(8676002)(82310400002)(36756003)(8936002)(4326008)(47076004)(53546011)(6506007)(336012)(26005)(186003)(82740400003)(81166007)(2906002)(478600001)(2616005)(70586007)(70206006); DIR:OUT; SFP:1101;
X-MS-Office365-Filtering-Correlation-Id-Prvs: c4a01cee-a669-44b7-0840-08d8000c6013
X-Forefront-PRVS: 0413C9F1ED
X-Microsoft-Antispam: BCL:0;
X-Microsoft-Antispam-Message-Info: z8dHw2IMMBd1MYVAU408hJ4xmlg0GwZkhtQjp1o7VzUNzK+WInJW6sSR1Z5LVlxv3QrlWgHPuNlGfMXcY7A4PZoOfayjltPpxju03EU9M3g1OPICzZoR3tfmrXvZQszWOVGtyxR+SotSRD2RZ+/yIF/w3HbdD6Gn+RclVSuq2TIlZ0iahcD9LiG7cq+RdxkCgFaNAPL5TGIg6VbZTOlkiE2NbVQ+JuBMfNR8XXovmjz/xMqqp/pxAQ8QOy7sS5QY5UuYhZw0jiPgpp9fCINykRcimyjNUwQP9ArFgM9O7rRsTHjI+oO06yZUY6Ht5GAsrzyTQutBPoDCKaEPz41951VUKuMquDMt9S8/AAUASuX41dD5j/yvoXKmj4M4XixEYahaW9kjahoD7WJt7vU4jw==
X-OriginatorOrg: arm.com
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 24 May 2020 18:00:49.3536 (UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: 251a2609-9598-4fe0-64d8-08d8000c6442
X-MS-Exchange-CrossTenant-Id: f34e5979-57d9-4aaa-ad4d-b122a662184d
X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=f34e5979-57d9-4aaa-ad4d-b122a662184d; Ip=[63.35.35.123]; Helo=[64aa7808-outbound-1.mta.getcheckrecipient.com]
X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem
X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM5PR0801MB1617
Archived-At: <https://mailarchive.ietf.org/arch/msg/tls/LLjpwGBFQF85aEvWYE4RQ-0vuLw>
Subject: Re: [TLS] Banning implicit CIDs in DTLS
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sun, 24 May 2020 18:00:56 -0000

On 22/05/2020, 01:09, "Christopher Wood" <caw@heapingbits.net> wrote:
> On Thu, May 21, 2020, at 9:22 AM, Thomas Fossati wrote:
> > Hi Chris,
> >
> > On 21/05/2020, 17:00, "Christopher Wood" <caw@heapingbits.net>
> > wrote:
> > > *One proposal to address this is by extending the AAD to include
> > > the pseudo-header. However, the chairs feel this is an unnecessary
> > > divergence from QUIC.
> >
> > I don't understand the "unnecessary" in the above para, i.e., why
> > are we so tied to QUIC in this case?  I'm asking because it looks
> > like this was a core criterion in the Chairs' proposal.

> Sorry for the confusion! The point here was that QUIC authenticates
> what's on the wire, which we felt was important. I should have spelled
> that out. There are of course other things to consider, as Martin
> points out.

OK, thanks for clarifying.

I want to be able to use implicit CIDs so I don't support PR#148 as-is.

As much as I'd like to go for a pure pseudo-header approach, I don't
think I have enough data at this point in time that I'd feel safe going
that way.

Since adding implicit CID to the AD doesn't look like a big deal in
terms of performance overhead, that would be my preference.

cheers, t

IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.

v2.23.0 | Report a Bug | By Email