IETF Logo Mail Archive

Re: [TLS] [DTLS] ACK's for post-handshake authentication requests

Hanno Becker <Hanno.Becker@arm.com> Thu, 02 April 2020 17:59 UTC

Return-Path: <Hanno.Becker@arm.com>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AE48B3A0FB4 for <tls@ietfa.amsl.com>; Thu, 2 Apr 2020 10:59:43 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.898
X-Spam-Level:
X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, SPF_PASS=-0.001, UNPARSEABLE_RELAY=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=armh.onmicrosoft.com header.b=nshPv7Rb; dkim=pass (1024-bit key) header.d=armh.onmicrosoft.com header.b=nshPv7Rb
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yP7BPIja0JjK for <tls@ietfa.amsl.com>; Thu, 2 Apr 2020 10:59:40 -0700 (PDT)
Received: from EUR01-DB5-obe.outbound.protection.outlook.com (mail-eopbgr150075.outbound.protection.outlook.com [40.107.15.75]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3C0CC3A0FAC for <tls@ietf.org>; Thu, 2 Apr 2020 10:59:39 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=armh.onmicrosoft.com; s=selector2-armh-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=aC0g9GuOrrYpfT4s3oIDAfXJHTOXVfQ+1AIMyY5+/C4=; b=nshPv7RbeI/5MTUReVpaxWxfOVUzyQnB6Hkf98L3xgsD8LxPzmQotSNAgDT4rFhwYin5NqtkhAzQ0RUtGKp8HAbdZYo74rwrp9NkEBZO4MEupHNoAX5rJ2wqopIIdoMq4+61jARG7LcWvvH3yayIGlwcQMK2Rw6lC482cmLc28M=
Received: from AM0PR0402CA0036.eurprd04.prod.outlook.com (2603:10a6:208:15::49) by HE1PR0801MB1722.eurprd08.prod.outlook.com (2603:10a6:3:87::18) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2878.15; Thu, 2 Apr 2020 17:59:37 +0000
Received: from AM5EUR03FT034.eop-EUR03.prod.protection.outlook.com (2603:10a6:208:15:cafe::cd) by AM0PR0402CA0036.outlook.office365.com (2603:10a6:208:15::49) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2878.15 via Frontend Transport; Thu, 2 Apr 2020 17:59:37 +0000
Authentication-Results: spf=pass (sender IP is 63.35.35.123) smtp.mailfrom=arm.com; ietf.org; dkim=pass (signature was verified) header.d=armh.onmicrosoft.com;ietf.org; dmarc=bestguesspass action=none header.from=arm.com;
Received-SPF: Pass (protection.outlook.com: domain of arm.com designates 63.35.35.123 as permitted sender) receiver=protection.outlook.com; client-ip=63.35.35.123; helo=64aa7808-outbound-1.mta.getcheckrecipient.com;
Received: from 64aa7808-outbound-1.mta.getcheckrecipient.com (63.35.35.123) by AM5EUR03FT034.mail.protection.outlook.com (10.152.16.81) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2856.17 via Frontend Transport; Thu, 2 Apr 2020 17:59:36 +0000
Received: ("Tessian outbound 4b84da486446:v50"); Thu, 02 Apr 2020 17:59:36 +0000
X-CheckRecipientChecked: true
X-CR-MTA-CID: 7ec6b3f687dd7446
X-CR-MTA-TID: 64aa7808
Received: from 1d208dbe32a3.1 by 64aa7808-outbound-1.mta.getcheckrecipient.com id 25BA2265-870E-453A-8BE7-22FEE4C58B0C.1; Thu, 02 Apr 2020 17:59:31 +0000
Received: from EUR05-DB8-obe.outbound.protection.outlook.com by 64aa7808-outbound-1.mta.getcheckrecipient.com with ESMTPS id 1d208dbe32a3.1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384); Thu, 02 Apr 2020 17:59:31 +0000
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=GnnQhhQYrWT8wopwEAjMwQL5WCN2hMNlIrcxx2qCFKPKNANMt+elSMfPrO2rR0qwaIHAAxQW9pFZy0shSqrretZ/TTLK2Tvqvaev6TFXlnumU3P9e80k0hiJpzNpxdBXi6nMknzrmjtLOMfM8QGbTAEfDLcnvE7Ljajk/Wh5cRPygpJPfcw36wynQMozbLvPj/CbKbmAnc+USN368bdbhB/VkYnk3rPAREmIcJSjPmPmfHP7gAdMzs7PB6mjCPo7OSk/Z8fNRHdeqBdGfI8WLALH5y7uzLE1mTG8BTUVyto9fIwYho8coyrSvo0yBQFCRwSB7u2GvAcYmzkv5lrtmA==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=aC0g9GuOrrYpfT4s3oIDAfXJHTOXVfQ+1AIMyY5+/C4=; b=nHqHJCLekGyH70Wqxb3Bw51TKWBS/L1koNwzlJgbJIR0r+o2ED0zb3QLmlryeGOG5o3v6awQ8adEKNj8h737JFhBgk+RT+sTMCzdUg6vUZkYwi5XNLU6MVyZWCvIt5V0/VisTtTNb6jimSX4zUt0KSKzlK0TPwHfyfdC2NLh/vda8R32CNbHnM0ZMYSHS7dJHWPwqgxI4aThJyasmr9EP31J3t7hHoterabz5j+aFC4ckk+wUGXtMPfad8toScIbm7rWz/m8XeMkfdBM2JT34vtcxf+7P2rHodpUcLC+S7IORhD4Zqwb+KBw/iFjjJn3jeroRFT0f6O6tcuy4zl/Yg==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=arm.com; dmarc=pass action=none header.from=arm.com; dkim=pass header.d=arm.com; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=armh.onmicrosoft.com; s=selector2-armh-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=aC0g9GuOrrYpfT4s3oIDAfXJHTOXVfQ+1AIMyY5+/C4=; b=nshPv7RbeI/5MTUReVpaxWxfOVUzyQnB6Hkf98L3xgsD8LxPzmQotSNAgDT4rFhwYin5NqtkhAzQ0RUtGKp8HAbdZYo74rwrp9NkEBZO4MEupHNoAX5rJ2wqopIIdoMq4+61jARG7LcWvvH3yayIGlwcQMK2Rw6lC482cmLc28M=
Received: from DB7PR08MB3324.eurprd08.prod.outlook.com (52.135.128.161) by DB7PR08MB3084.eurprd08.prod.outlook.com (52.135.128.159) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2856.20; Thu, 2 Apr 2020 17:59:30 +0000
Received: from DB7PR08MB3324.eurprd08.prod.outlook.com ([fe80::41f6:faee:c1f4:6abe]) by DB7PR08MB3324.eurprd08.prod.outlook.com ([fe80::41f6:faee:c1f4:6abe%6]) with mapi id 15.20.2856.019; Thu, 2 Apr 2020 17:59:30 +0000
From: Hanno Becker <Hanno.Becker@arm.com>
To: Eric Rescorla <ekr@rtfm.com>
CC: "tls@ietf.org" <tls@ietf.org>
Thread-Topic: [TLS] [DTLS] ACK's for post-handshake authentication requests
Thread-Index: AQHWBEwPb41Ly5OD9EyF9O8aRHZFyqhcoY4AgAmGUJc=
Date: Thu, 02 Apr 2020 17:59:30 +0000
Message-ID: <DB7PR08MB3324605B40FBB90DD10F3A959BC60@DB7PR08MB3324.eurprd08.prod.outlook.com>
References: <AM6PR08MB3318DB8A2848E5B9401EC1469BCC0@AM6PR08MB3318.eurprd08.prod.outlook.com>, <CABcZeBPKxaR_F-x8KYysB2hq7jxhqhswF36ZkrDEBKx2gXzEBg@mail.gmail.com>
In-Reply-To: <CABcZeBPKxaR_F-x8KYysB2hq7jxhqhswF36ZkrDEBKx2gXzEBg@mail.gmail.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
Authentication-Results-Original: spf=none (sender IP is ) smtp.mailfrom=Hanno.Becker@arm.com;
x-originating-ip: [217.140.99.251]
x-ms-publictraffictype: Email
X-MS-Office365-Filtering-HT: Tenant
X-MS-Office365-Filtering-Correlation-Id: 3e35220d-7142-403f-771a-08d7d72f9b9f
x-ms-traffictypediagnostic: DB7PR08MB3084:|HE1PR0801MB1722:
X-Microsoft-Antispam-PRVS: <HE1PR0801MB172259E30382DB69F7A2D30E9BC60@HE1PR0801MB1722.eurprd08.prod.outlook.com>
x-checkrecipientrouted: true
nodisclaimer: true
x-ms-oob-tlc-oobclassifiers: OLM:10000;OLM:10000;
x-forefront-prvs: 0361212EA8
X-Forefront-Antispam-Report-Untrusted: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:DB7PR08MB3324.eurprd08.prod.outlook.com; PTR:; CAT:NONE; SFTY:; SFS:(10009020)(4636009)(396003)(346002)(136003)(376002)(39860400002)(366004)(81166006)(33656002)(8936002)(6916009)(4326008)(316002)(19627405001)(81156014)(53546011)(7696005)(6506007)(2906002)(76116006)(478600001)(5660300002)(9686003)(52536014)(66446008)(71200400001)(8676002)(55016002)(66946007)(64756008)(66476007)(186003)(966005)(86362001)(26005)(66556008); DIR:OUT; SFP:1101;
received-spf: None (protection.outlook.com: arm.com does not designate permitted sender hosts)
X-MS-Exchange-SenderADCheck: 1
X-Microsoft-Antispam-Untrusted: BCL:0;
X-Microsoft-Antispam-Message-Info-Original: qNVPRbuTndyVserdPRIQQ3xkTAS6ik2gfNE3tM7EkGMhJ0JIC+EikW40Kcqi7272YBSgnwlGMV9QvoAP+ZkdPIlierOjUPA+r+hhfUyffg6C2mDty6sEate6Ih2cIo+K5qPgJB2evkoFHr16HmiL8SyqBw9jlPRl73TDneZqgwtrYTyyiUyK7kyCfVYi9EVld5wbrTJ4bMejWJe0c9t4BAMsV2Cq2R7G/6ibkagPpdrI4IlP/JbOghDsF+lug3Ni1uMHlLkCQc5uSkpcI8TAC2sLfO/jAR0JnEWYtatDXk69LLjGAdqTYIhH7RlMJKRuGhZVmjRWRdOZhPLxZRMKvhh3bJiwgHboxvdN7Vf5OTutqJYP8Ib1eQl1nEnrBPapW6ty+xxYuJt3waDSf/8Aqh1GYJCNc7Tibjn3bFmjTrmCQafRl1Q8p7kkE9TsUOHFic1xC2lrOnAcFDbConri4jZfZSkqBKLLJ6c2nUZYycB8cPx3f2iTwfVtM9s0y1ijLs5LVWAv/sYH98C+WbaEBw==
x-ms-exchange-antispam-messagedata: 0EGs92M0zBPQj0hEuOI1yka0k08qrHsuyIrWi9NwGjns3yy787sVygUbAnowZuHQMVa62rK25XCYRfKQjrE5X1VsSen8cQzsb46ng+Mid3QzQJ5S89hmVFJppYLlBmdL8j1O77C1BIh+N+W/DLiQXg==
x-ms-exchange-transport-forked: True
Content-Type: multipart/alternative; boundary="_000_DB7PR08MB3324605B40FBB90DD10F3A959BC60DB7PR08MB3324eurp_"
MIME-Version: 1.0
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB7PR08MB3084
Original-Authentication-Results: spf=none (sender IP is ) smtp.mailfrom=Hanno.Becker@arm.com;
X-EOPAttributedMessage: 0
X-MS-Exchange-Transport-CrossTenantHeadersStripped: AM5EUR03FT034.eop-EUR03.prod.protection.outlook.com
X-Forefront-Antispam-Report: CIP:63.35.35.123; CTRY:IE; LANG:en; SCL:1; SRV:; IPV:CAL; SFV:NSPM; H:64aa7808-outbound-1.mta.getcheckrecipient.com; PTR:ec2-63-35-35-123.eu-west-1.compute.amazonaws.com; CAT:NONE; SFTY:; SFS:(10009020)(4636009)(136003)(376002)(39860400002)(396003)(346002)(46966005)(8936002)(86362001)(70206006)(70586007)(6862004)(9686003)(82740400003)(5660300002)(81156014)(55016002)(478600001)(26826003)(336012)(966005)(2906002)(53546011)(52536014)(47076004)(356004)(81166006)(186003)(36906005)(26005)(7696005)(19627405001)(6506007)(316002)(8676002)(33656002)(4326008); DIR:OUT; SFP:1101;
X-MS-Office365-Filtering-Correlation-Id-Prvs: 9af87bb2-c88a-4147-4ee4-08d7d72f97b7
X-Forefront-PRVS: 0361212EA8
X-Microsoft-Antispam: BCL:0;
X-Microsoft-Antispam-Message-Info: W8H7sNTEWsPlHha20A6JpXKV3A9dW9gGrCxnJtRw/nbAf4y0/tqrjnkoS3xB416se7LmhBRqNav2lAUNf8HvgyNTUtTWTfyKwRaVhNvCCX34b0Tnp9+HMLSCY6qFOsd0Fuxj8OwHxQzKPKUIgmyb+8wLbQx744DHIQBYjAdTrp/mtEsPa+ZthPcmqQp73IjNpQgeX6ye/HQnuxN6LXzLq+kQMFKzr0sAKIgX0f1qLq45JxjmO4EfhupAzGZiRsvdCIn+hT9z+XQt0y2EIdfwltSiMmhbFq5gPFyEJlIFoAAmYhWiZFJJ/JaF1XYZyTve3Lw1O/v9/AQF5MbDpXwU4LWpw3XsUW77E6e8F76azE8N2o3nl1wnY6Sa2qVSCMLv1m8lK9JWGiS1ZZOJ2CZqqyS0T6+hVB1ZeoDFPSrJ5KKgmVyBh1iTLuPcP/NxXP2cJtEN0kDQb5izeJCiT+QWbTEyMWD6Kle7eu7GCq51rkEyPRmgafRPYvtZqtrcFx/51WjcQXmsOemddkGZpgUyd2RDW7P+JorkD3pxxUAxGgxt1EjxnO+dGPwEDpLxETFWStqao4dFKdqJQVVxbGE2/A==
X-OriginatorOrg: arm.com
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 02 Apr 2020 17:59:36.9957 (UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: 3e35220d-7142-403f-771a-08d7d72f9b9f
X-MS-Exchange-CrossTenant-Id: f34e5979-57d9-4aaa-ad4d-b122a662184d
X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=f34e5979-57d9-4aaa-ad4d-b122a662184d; Ip=[63.35.35.123]; Helo=[64aa7808-outbound-1.mta.getcheckrecipient.com]
X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem
X-MS-Exchange-Transport-CrossTenantHeadersStamped: HE1PR0801MB1722
Archived-At: <https://mailarchive.ietf.org/arch/msg/tls/WPKRQ2RFAzyEQ9rSDFzUmk3KHNM>
Subject: Re: [TLS] [DTLS] ACK's for post-handshake authentication requests
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 02 Apr 2020 17:59:44 -0000

Thanks Ekr. I have created PR https://github.com/tlswg/dtls13-spec/pull/138 implementing the suggestion.
________________________________
From: Eric Rescorla <ekr@rtfm.com>
Sent: Friday, March 27, 2020 4:30 PM
To: Hanno Becker <Hanno.Becker@arm.com>
Cc: tls@ietf.org <tls@ietf.org>
Subject: Re: [TLS] [DTLS] ACK's for post-handshake authentication requests

Thanks. This seems like a good improvement. I have filed https://github.com/tlswg/dtls13-spec/issues/128 to track it.

On Fri, Mar 27, 2020 at 8:29 AM Hanno Becker <Hanno.Becker@arm.com<mailto:Hanno.Becker@arm.com>> wrote:
I have a minor comment on DTLS 1.3 draft 37.

On the topic of sending ACKs, the draft recommends:

```
ACKs SHOULD NOT be sent for other complete
flights because they are implicitly acknowledged by the receipt of
the next flight, which generally immediately follows the flight.
```

I wonder if the case of post-handshake authentication should be
explicitly mentioned as a potential exception to this rule, since
the TLS 1.3 RFC explicitly mentions that responses to
`CertificateRequest` may be delayed in some contexts:

```
Note: Because client authentication could involve prompting the user,
servers MUST be prepared for some delay, including receiving an
arbitrary number of other messages between sending the
CertificateRequest and receiving a response.
```

In this case, it would be beneficial to immediately explicitly ACK
the `CertificateRequest` message even though it is also implicitly
acked through the eventual response via the `Certificate` message.

Regards,
Hanno
IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.
_______________________________________________
TLS mailing list
TLS@ietf.org<mailto:TLS@ietf.org>
https://www.ietf.org/mailman/listinfo/tls
IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.

v2.46.0 | Report a Bug | By Email | System Status