IETF Logo Mail Archive

Re: [TLS] [EXTERNAL] Re: TLS 1.2 deprecation

Andrei Popov <Andrei.Popov@microsoft.com> Fri, 31 March 2023 02:29 UTC

Return-Path: <Andrei.Popov@microsoft.com>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 75099C14CF1A for <tls@ietfa.amsl.com>; Thu, 30 Mar 2023 19:29:29 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.099
X-Spam-Level:
X-Spam-Status: No, score=-2.099 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RCVD_IN_ZEN_BLOCKED_OPENDNS=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com
Received: from mail.ietf.org ([50.223.129.194]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dTM0ZpXKOuCy for <tls@ietfa.amsl.com>; Thu, 30 Mar 2023 19:29:28 -0700 (PDT)
Received: from DM5PR00CU002.outbound.protection.outlook.com (mail-cusazlp170110003.outbound.protection.outlook.com [IPv6:2a01:111:f403:c111::3]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id F40B9C1522AF for <tls@ietf.org>; Thu, 30 Mar 2023 19:29:26 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=jCBuZfeM8X3CjLE9+sa3T260XBQwemGDD0LH9lEJttnUosB3FSAeFWfE40MSvCt0WfP6mUsc2EgvJyOlBBDrlvps0ejuMU6SXMrDDMGB0CrsC/HYJQWFuO+KuWeibI+XkTOpTrivGMJxSAgjnJsw2vkHQFM4Hr31CcuYoxhnZW5w5ELsLbIPVLe3IfXbqzMG9geFeY3PjjQyxuhn59OZHxO/DK9PIAynQKkdz8q26xSXVzftB0y1lXRZr3snGh8QkxA8NkyTmx7MUOGCjfXnTS0ScIn0nZpO2n2OT9BqenEJbpZKyAy52fWG7bL7rPAOQ4KLaKaq666Gxc8DlV9TIw==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=8QpDvyF34ZHt97ztA1YXEbZiptHCWsGlVsP0gnEJJgE=; b=go4KV4Acr1iXmwUOHqxsFcmFbSQXSSvnOIujBy5N6VCELMoXLSZJu65phvUqji0g/Lg277NkRdjiSz+huiDgbHHLZLq51KtoZIKHixG1PzwnzfeAwphn6lv8Fm6tRzGwuwL9Nh6XT9igYBpXAGuciQhzKYR6BCO9inHmcZUrOP8BtvxpjyCY5mdtTSnAmDQDtAd3cOZoQe5YnWWBO8g03vyDzonumIFMbhStrCZ8suIVeqPOtu9hG5LA7pMyNMiHbYaZ23kIEsM8wvKHecSN79Ms6v40Zw+l8Dsbq9ClOGjJ6JJ6RghYgJvID3gD74Jte0Rk4k4q9u1a5wwF/9Y6yw==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=microsoft.com; dmarc=pass action=none header.from=microsoft.com; dkim=pass header.d=microsoft.com; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=8QpDvyF34ZHt97ztA1YXEbZiptHCWsGlVsP0gnEJJgE=; b=jENbd8+Bf/6qpzrJsXbwXL+wTvji0JSEVxm+dbCfo/2pVv2AGaSbpfwdzqhsUms8i86hL8RjxmFJXzMASAvayGhPdqaXCegiaTke/uCO5XXMtaod+i2rMruG2FdAbeuMOZbKBk1TrfH5kt2VD2SBXitlsZOcHGac9U22PFtHIVA=
Received: from MN2PR00MB0687.namprd00.prod.outlook.com (2603:10b6:208:1d2::18) by CH2PR00MB0695.namprd00.prod.outlook.com (2603:10b6:610:78::24) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6297.0; Fri, 31 Mar 2023 02:29:23 +0000
Received: from MN2PR00MB0687.namprd00.prod.outlook.com ([fe80::8883:47e8:4fa5:842a]) by MN2PR00MB0687.namprd00.prod.outlook.com ([fe80::8883:47e8:4fa5:842a%6]) with mapi id 15.20.6297.000; Fri, 31 Mar 2023 02:29:22 +0000
From: Andrei Popov <Andrei.Popov@microsoft.com>
To: Rob Sayre <sayrer@gmail.com>, David Benjamin <davidben@chromium.org>
CC: "TLS@ietf.org" <tls@ietf.org>
Thread-Topic: [EXTERNAL] Re: [TLS] TLS 1.2 deprecation
Thread-Index: AQHZY0YRmm9P5BU1Pkq5rvGdgfDpv68T74wAgAAGGoCAADO9QA==
Date: Fri, 31 Mar 2023 02:29:22 +0000
Message-ID: <MN2PR00MB06877B2D3FF4857774013EB68C8F9@MN2PR00MB0687.namprd00.prod.outlook.com>
References: <CAChr6Sz0v=Amf7FwbS3XGEt1NsOpU-1zja8x5Tp_Lyj2cZFvBg@mail.gmail.com> <CAChr6SzQjbFsq4Q2q7He0nbP7xMm4ca+iHP_g1rjARTWAT8SgA@mail.gmail.com> <CAF8qwaBtZkp6R0aO1W+0nU8Zhk4mJo=y=9jaPCO1aqZ7Xcn8jw@mail.gmail.com> <CAChr6SxYJF0oZnN-yxQfdLMxqE34spKXfqk_7YrnPULW33sHHA@mail.gmail.com>
In-Reply-To: <CAChr6SxYJF0oZnN-yxQfdLMxqE34spKXfqk_7YrnPULW33sHHA@mail.gmail.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
msip_labels: MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_ActionId=93695fb3-2f08-44aa-b88b-41d5f7499e3e; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_ContentBits=0; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Enabled=true; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Method=Standard; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Name=Internal; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SetDate=2023-03-31T02:24:49Z; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SiteId=72f988bf-86f1-41af-91ab-2d7cd011db47;
authentication-results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=microsoft.com;
x-ms-publictraffictype: Email
x-ms-traffictypediagnostic: MN2PR00MB0687:EE_|CH2PR00MB0695:EE_
x-ms-office365-filtering-correlation-id: 21d21f37-89a7-4278-eb9d-08db318fbd3d
x-ms-exchange-senderadcheck: 1
x-ms-exchange-antispam-relay: 0
x-microsoft-antispam: BCL:0;
x-microsoft-antispam-message-info: pNIj2aoCa3//7gtKSu9IPKzGDNcB8Yq47SIEIJ2OrUB/q3NTU/Np0Z5blY03MlRZZlTJCW3+68O5SUHOjXw8MqreiMVn1riK3pAK5L5H+J99U2LIqvKCbubVpZ7Q5N26qxXEbqvh+/uRa8XxStfl0txW5xXm64A+PGKwhuUGwI++C7N1twxwD4lbE+I9B1jY8UNZtHmJU8iQfYnjjGQvTaeSHByY6bZ9ss4C079+agLGnQUEzCUWBELxOqPE32ovM93YgH2wNDH3u1xEBceGjs0gEJ7KWrBEfbAB/D+jodGEf4buKOc0RnN7/ecxSRNNh0wQRttbbEa+c7PEhWYCEwc6n+kANVcPS96srWjVkPFfPw9in8lm5+RXF7E6raLbPEZ64f1iopDbQzHT68/xs6AE6rR2o7YiQmakKv0NB1ipaE2nyUMOoAkbIEGitrL6SdNGQ0xrRnsb+UGbLRFo1unSwY2yfrDXtoGX14emYTBPbXk8tWwiPu3kjlgg7FIE5G/X73nD3BAlz2/BbnPrmUMQCiW3WcynqwyWUzUh8KlV3eZq/vcxmZoZX8Qz4P8/M6ODjWmri3vDzQUAn7z4AlHvp2ETP8FdaUqO/cyI6IDr6EIYvlCBhYGHW+OQi1HKn4j4U552wEHrd4N3B/gseY5PktYjw1XRe6zmCDq2frs=
x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:MN2PR00MB0687.namprd00.prod.outlook.com; PTR:; CAT:NONE; SFS:(13230028)(4636009)(39860400002)(376002)(366004)(346002)(136003)(396003)(451199021)(83380400001)(53546011)(71200400001)(478600001)(316002)(186003)(786003)(7696005)(10290500003)(9686003)(110136005)(2906002)(26005)(8990500004)(6506007)(5660300002)(76116006)(8936002)(38070700005)(38100700002)(33656002)(122000001)(66556008)(66476007)(52536014)(8676002)(55016003)(66446008)(82960400001)(41300700001)(64756008)(82950400001)(4326008)(86362001)(66946007); DIR:OUT; SFP:1102;
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: +MhNvGgx5yLsGBUIq0OHVB9WbqrtFOyvNQ+NL1EWiRww2rebeJIM3OvEkhQNd7ucWi3BOedoG5fx7S6kG/6Q1AW1zQ9uBgDDm1nWvglL4ph8bSY6yxCrGRZvpL3dJ/lcCfnA6unmMTKcQtiwvpxEmPAzxclv5jd88O3A3+D/JJoiWvVYbxn7jMqUuRrV/NwX96yUa/umn3LyNv3WHIeM0IYSHhwkKO3vybd7TRU3C37Oezpt1vvBEXpiNNBXBGY6QNUBy5T5XzmcjmAxIgIYYWR/0aV6VRpZx5wg0Rf+fUHe7KjO4nWyA9/czymz1zm7c9+rRCGD8txD/D2HmwnMwskY8emtjCrWr2+Spkjge6WCujtsJa9Q1PLt4Cgdnlw4jtr2BqiNbMhVI7WSSgYNFgD2Lge6C4Lo6ck0DZn6X0sK0DrB0P0SR+mO3rBmVCwlVMFP4yhTbL2PGl9fUxO94qsv4or5RBk470kLtpqaGyB/kIGQILdQWLvl9jbg4q77c338mNW9yF4BCtuwuRO11sWgK1dn+1PYmlY95tdf07Ra5VAwbYz/Iy4ARxpag3v1OjWvXOhQfH0IsJn0HsFBWYCyIrcygEKZgpgE07fR2acGJlAxR4KPvs/s7DmE6UGyMq+a3AgS+qVRjWXsqQC+rOYekWR7JPxNKcZvnI18UqwzipxfsI45oVdsjshTUiaIHWgThy4Ff3IKczYiVVBkAl3ROFpnK703K1sjzJQFgWnCk5X+wzItkI3aq+RGamhpH4tf5sP7DGvbox585G/Lu6FnN15JMVmtKJRQ5mK58XP7kw69HW1yJX6mFQLVXTB4AP4aX/BJUkuNe7LXf261F2u2A38N3z7T4pDX5dYjQ7ZGJZmZgbDhdArqYOzXQqu9vQBFz5Rlacc11/wIuwHJdiwCkEoiSV+3px/A+uW5cAbr0O/SoZW4dThWg/8VGV879TujPjfKLMZodmeFbmyISkZzkPl/8Fjo99GJOCpfDxqhA9rGw4axKD3NFDINjsc8cmvk32uAKM3mMVVwgnGAvv1bgT1c3ItYv7FJ1TWv247uAtdqwBclOvGB20y3TrVa4p79ws5lamnaHSt9XDSPVhghqW6i5zTlkwcpD8g5gLpCyPwb2El2aurx9KUC/Y4Jh8OSMnFZ+uQS8HR5WxmA6HdQhxt39qvenQamD/qv4111wWUCqZd3688Xk+l1jL3t5RM+qNaY2RtxTncknKsNXGRVNWsT0LZR2ykAKx3rbPzKgVeU+ws/1C9WzEPUsywS02EaiIempSru0iTGAPlNnPH44lBH0kl/X7Hbj8/ka7ntf+QlfNcBg6cSsSkqxUU268PEGgYEAYfBhlcGaRbngGPoCz+558rfDoi6XkNwKtZlINyXgJcLQZ98Xba7LSQXbNazqwyyXaLia38Q9MBpAoIzoI9UNfmN/LKh/PImL1aWeDaRukSXpV+ZgeM3OqnsdMjifWFF6TOmvQBxpBHv+k+3zOOJzsxBD5Fb5sIbJleLzNyTAKkc2EQ0fHzttXjYGTPPep8r1Mucvos1KmySivP3Eqjy/BCnnWQWDPSSXSC2x9ozr3pmzNxlZiBcwAsM
Content-Type: multipart/alternative; boundary="_000_MN2PR00MB06877B2D3FF4857774013EB68C8F9MN2PR00MB0687namp_"
MIME-Version: 1.0
X-OriginatorOrg: microsoft.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: MN2PR00MB0687.namprd00.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 21d21f37-89a7-4278-eb9d-08db318fbd3d
X-MS-Exchange-CrossTenant-originalarrivaltime: 31 Mar 2023 02:29:22.7744 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: IXqKW5xyHd43GUh/GHI7OrrbRL6ipBVsO8/hTj7PS3IIIzdo2Ds6SjDOnMWMS/lvxkZql129RTCjhpKheIbpXQ==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH2PR00MB0695
Archived-At: <https://mailarchive.ietf.org/arch/msg/tls/Ldz_BaviUWVedEn1asZ3hlaPdQk>
Subject: Re: [TLS] [EXTERNAL] Re: TLS 1.2 deprecation
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.39
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 31 Mar 2023 02:29:29 -0000

IMHO, no reason to add post_handshake_auth to TLS 1.2, because TLS 1.2 already supports renegotiation.
While renegotiation had its share of issues we had to patch over time, doing TLS 1.2 client auth without renegotiation leaks client identity.

Cheers,

Andrei

From: TLS <tls-bounces@ietf.org> On Behalf Of Rob Sayre
Sent: Friday, March 31, 2023 8:20 AM
To: David Benjamin <davidben@chromium.org>
Cc: TLS@ietf.org
Subject: [EXTERNAL] Re: [TLS] TLS 1.2 deprecation

On Thu, Mar 30, 2023 at 3:58 PM David Benjamin <davidben@chromium.org<mailto:davidben@chromium.org>> wrote:
post_handshake_auth was only in TLS 1.3 because some folks relied on an existing (and terrible :-) ) corresponding mechanism in TLS 1.2: trigger a renegotiation and request a client certificate in the new handshake. I don't think it makes sense to backport post_handshake_auth to TLS 1.2. Such a backport would also require much more analysis than the average extension, since it concerns authentication.

No disagreement from me. My point was only that such things are already in the IANA registry.

thanks,
Rob

v2.46.0 | Report a Bug | By Email | System Status