Re: [TLS] I-D Action: draft-ietf-tls-grease-02.txt

[David Benjamin <[e-mail]>]

On Thu, Jan 24, 2019 at 5:03 PM Martin Thomson <[e-mail]> wrote:

> On Fri, Jan 18, 2019, at 07:23, David Benjamin wrote:
> > > while record_size_limit extension sends just one value, it does
> > > specifically
> > > allow the client to advertise higher values than the protocol versions
> or
> > > extensions would indicate
> > >
> > > I wonder if sending such values shouldn't be part of GREASE behaviour,
> > > even if
> > > it wouldn't use GREASE values...
> > >
> >
> > I think that should be sorted out in a separate document. This one's been
> > sitting around for a while as it is, and record_size_limit doesn't have
> an
> > RFC to cite yet. :-)
>
> I'm in two minds about this.  On the one hand, we don't need any actual
> machinery here, so why do anything?  On the other hand, it's just a note
> that this is possible, and adding that sort of note is easy.
>
> > The record_size_limit extension {{!RFC8449}} includes a value that can
> be greased by endpoints that don't place constraints on their record size.
> Advertising values larger than the protocol supports is permitted and has
> no effect on the behavior of a compliant peer.
>

I don't feel very strongly either way, though it is odd that it basically
contradicts the sender's rules in RFC 8449.

   Higher values are currently reserved for future
   versions of the protocol that may allow larger records; an endpoint
   MUST NOT send a value higher than the protocol-defined maximum record
   size unless explicitly allowed by such a future version or extension.
   A server MUST NOT enforce this restriction; a client might advertise
   a higher limit that is enabled by an extension or version the server

It does say "unless explicitly allowed by such a future version or
extension", so this is basically blanket overruling that sentence a few
months after publication. (But overruling it isn't entirely wrong, given
the current text imposes a future-proofing receiver rule that the sender is
forbidden from checking.)

David