Re: [TLS] Fate of resumption

[Erik Nygren <[e-mail]>]

On Sat, Oct 18, 2014 at 12:16 PM, Eric Rescorla <[e-mail]> wrote:

> I wanted to get the discussion going on whether we need resumption [0] or
> not
> for TLS 1.3. This may be a quick discussion as I suspect the answer is
> yes, but I figure we should decide it rather than just assuming it.
>

+1 for leaving in resumption for TLS 1.3, for the reasons mentioned.

Resumption is another part of the "istlsfastyet" story that helps in selling
people on making TLS more ubiquitous, both from a performance
and cost perspective.  Dropping it at this point might harm adoption
of both TLS 1.3 as well as momentum towards TLS in general.

(Some of the other discussions on this topic focused on best
practices around session ticket key management.  If resumption
is going to stick around, then ideally there should be a BCP or similar
on sane implementation practices that do as little harm to forward secrecy
as possible.)

One other thing we may wish to consider is the relative safety
and complexity and interactions of 0RTT vs Resumption for various scenarios,
such as against replay attacks (when nonces are available and
when they aren't available).

       Erik