Re: [TLS] TLS 1.3 process

On Fri, Mar 28, 2014 at 11:34 AM, Eric Rescorla <ekr@rtfm.com> wrote:
>
>
>
> On Fri, Mar 28, 2014 at 7:40 AM, Nikos Mavrogiannopoulos <nmav@redhat.com>
> wrote:
>>
>> On Fri, 2014-03-28 at 10:12 -0400, Salz, Rich wrote:
>> > > The TLS WG charter is pretty clear that the intention isn't to design
>> > > a completely new protocol but rather to revise TLS,
>> > > and specifically to "place a priority in minimizing gratuitous changes
>> > > to TLS."
>> > +1.
>> >
>> > It seems to me that there are almost three viewpoints within this WG.
>> > With the hope that I'm equally unfair to everyone, I'd summarize them like
>> > this:
>> >       - Update to modern crypto knowledge to fix bugs, and some modern
>> > features and be done
>> >       - Make big changes to fix serious problems
>> >       - Start over from a clean sheet; "I don't know what it will be,
>> > but we'll call it TLS."
>> > I put myself in the first group (except for SNI encryption, which will
>> > get a separate post :), could be convinced to support something from the
>> > second once it's written down, and am probably not qualified to evaluate
>> > anything from the third group (few people are). Interestingly, barring
>> > divine intervention, the above list is probably in order of length of time
>> > needed, as well. That would seem to indicate that there's room for all three
>> > efforts here.
>>
>> This is not my impression of the discussions and the meetings. Eric in
>> the last meetings has presented a list of changes to the protocol that
>> really exceeds the "Update to modern crypto knowledge to fix bugs, and
>> some modern features and be done", (whatever that means).
>>
>> So my understanding is that there will be big changes (e.g., reducing
>> handshake messages, redesign of handshake to encrypt everything) to fix
>> serious and not serious problems (e.g., reducing the round-trips),
>
>
> Yes, I think the changes to the handshake we have been discussing
> probably would fall under #2 in Rich's taxonomy.

But what Rich neglected to point out is that you have to do #1 anyway.
The bugs in TLS 1.2 and older versions need fixing. If you end up
tying that fix together with a bunch of bigger changes, they won't get
fixed because people will (incorrectly) see this as a new version
rather than a bundle of necessary fixes with some new features.

There is no reason to bundle the record layer/handshake fixes and
handshake enhancements together.

>
>
>>
>> and
>> the question is whether to do it:
>> 1. within the working group (which is stated to have no crypto
>> expertise).
>> 2. by using external expertise.
>
>
> I actually don't think think this is the question, since IETF work is
> done in WGs and we would reach out (and are reaching out) for
> external expertise in any case.

Kenneth Patterson and Peter Gutmann are in the WG.

Sincerely,
Watson Ladd
>
> -Ekr
>
>
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls
>

-- 
"Those who would give up Essential Liberty to purchase a little
Temporary Safety deserve neither  Liberty nor Safety."
-- Benjamin Franklin