Re: [TLS] Session resumption ticket reuse considered harmful

[Watson Ladd <[e-mail]>]

On Thu, Mar 5, 2020 at 3:08 PM Nico Williams <[e-mail]> wrote:
>
> On Thu, Mar 05, 2020 at 02:49:23PM -0800, Watson Ladd wrote:
> > On Thu, Mar 5, 2020 at 12:55 PM Nico Williams <[e-mail]> wrote:
> > > .... unless both parties agree.  It takes two to agree.
> >
> > As far as I am aware session tickets being single use isn't enforced
> > by any server right now: it's a desirable but theoretical property for
> > 0-RTT.
>
> Is that so?  Will that remain so?
>
> > My skepticism is entirely a function of this being a late breaking
> > [...]
>
> What is late breaking to you?
>
> The change was proposed during WGLC.  If before or during WGLC is too
> late, when is it not too late?  At WG work item adoption call?

It depends on the relative size of the change and the importance of
the issue. An important central issue that went completely unnoticed:
unfortunate, but completely reasonable to require addressing, e.g. "we
did an experiment and it doesn't work". A large extension of scope, or
a seemingly small one that complicates everything? That hopefully gets
brought up early enough to not massively delay everything else. That's
particularly true when it's unclear what is actually needed to serve
the desired goal.

>
> See also my post about feature matrix issues.
>
> > [...]
> > change to a relatively simple proposal, with not very much in the way
> > of quantifiable evidence to back up the concern that shared cache
> > contention is a big overhead. Is it 1%? .5? 10%? of the total time to
> > use a connection. At 10% we definitely need to do something, at .01%
> > we almost certainly don't.
>
> Right, but this is where the "Postfix architecture" issue comes in.  I'm
> having a conversation with him about this.  Viktor might be confused
> about the CoW properties of LMDB, but in any case, the wire bandwidth
> waste and server compute waste issues have nothing to do with Postfix's
> architecture/design/implementation.

Tickets are small and issuance is cheap. Where are the *hard numbers*
to back up the assertions being made that ticket reuse is an important
savings?

Sincerely,
Watson