Re: [TLS] Potential New Handshake Flows for TLS 1.3

[Nikos Mavrogiannopoulos <[e-mail]>]

On Tue, Nov 5, 2013 at 10:08 PM, Eric Rescorla <[e-mail]> wrote:
> I've just submitted a document on potentially new reduced RT/more
> private protocol flows for TLS 1.3. It's fairly handwavy ATM but I wanted
> to err on the side of getting some of the ideas out for discussion
> so we could figure out which avenues we want to pursue. This draft
> borrows (steals) liberally from a bunch of prior work too numerous
> to name here.

I don't quite like that all the abbreviated handshakes make use of
cached information. Does this really scale? I mean do we expect each
client to keep a database of every host it connected? I'm afraid that
if cache information are required then these handshakes will be used
to connect to popular sites, and everyone else will be using the old
non-cached-data depended handshake. This adds complexity as everyone
would have to implement the old and the new handshakes.

In fact the same effect with cached information is present with
session tickets, which is even lighter and available today.

Maybe instead of cached information, move the choice of the parameters
to the client (and maybe give the server the option to discard them
and use others at the cost of an additional RTT and a
ClientKeyExchange).

The handshakes in Figure 6 and 7 look quite promising (although I
don't get the idea of AlmostFinished). What is its purpose?

regards,
Nikos