IETF Logo Mail Archive

[TLS] Abridged Certificate Compression (server participation)

"Kampanakis, Panos" <kpanos@amazon.com> Wed, 12 July 2023 04:02 UTC

Return-Path: <prvs=550032d12=kpanos@amazon.com>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EF295C151AF1 for <tls@ietfa.amsl.com>; Tue, 11 Jul 2023 21:02:14 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -11.898
X-Spam-Level:
X-Spam-Status: No, score=-11.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H5=0.001, RCVD_IN_MSPIKE_WL=0.001, RCVD_IN_ZEN_BLOCKED_OPENDNS=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=amazon.com
Received: from mail.ietf.org ([50.223.129.194]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id AjS2REbcGN5x for <tls@ietfa.amsl.com>; Tue, 11 Jul 2023 21:02:12 -0700 (PDT)
Received: from smtp-fw-6001.amazon.com (smtp-fw-6001.amazon.com [52.95.48.154]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A39A9C151AEF for <tls@ietf.org>; Tue, 11 Jul 2023 21:02:12 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amazon.com; i=@amazon.com; q=dns/txt; s=amazon201209; t=1689134533; x=1720670533; h=from:to:subject:date:message-id: content-transfer-encoding:mime-version; bh=fro8hSVbmMZRxt1xTcvL/s6elkPk5gEUOLK95CBbxsc=; b=VNTOSdgTdOW8wE2cz//lPVrZnhYpfzWNPwR32P7zkI9PRDqvUYaJ/gR3 U151SbaaGHZ0RhnShtrjvroAlkG21YfzbsgCYwcCTotapVN7NPEZ2flao h5fA9V4nkJn6eZOMxSpMhv/JeYlCmN57Ie1z/iZmT7D6JFtkM2gZpqcns 4=;
X-IronPort-AV: E=Sophos;i="6.01,198,1684800000"; d="scan'208";a="346279350"
Received: from iad12-co-svc-p1-lb1-vlan2.amazon.com (HELO email-inbound-relay-iad-1e-m6i4x-245b69b1.us-east-1.amazon.com) ([10.43.8.2]) by smtp-border-fw-6001.iad6.amazon.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 12 Jul 2023 04:02:12 +0000
Received: from EX19MTAUWC001.ant.amazon.com (iad12-ws-svc-p26-lb9-vlan3.iad.amazon.com [10.40.163.38]) by email-inbound-relay-iad-1e-m6i4x-245b69b1.us-east-1.amazon.com (Postfix) with ESMTPS id 29A88340049; Wed, 12 Jul 2023 04:02:10 +0000 (UTC)
Received: from EX19D001ANA001.ant.amazon.com (10.37.240.156) by EX19MTAUWC001.ant.amazon.com (10.250.64.174) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1118.30; Wed, 12 Jul 2023 04:02:10 +0000
Received: from EX19D001ANA001.ant.amazon.com (10.37.240.156) by EX19D001ANA001.ant.amazon.com (10.37.240.156) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA) id 15.2.1118.30; Wed, 12 Jul 2023 04:02:09 +0000
Received: from EX19D001ANA001.ant.amazon.com ([fe80::4f78:75cd:3117:8055]) by EX19D001ANA001.ant.amazon.com ([fe80::4f78:75cd:3117:8055%5]) with mapi id 15.02.1118.030; Wed, 12 Jul 2023 04:02:09 +0000
From: "Kampanakis, Panos" <kpanos@amazon.com>
To: Dennis Jackson <ietf=40dennis-jackson.uk@dmarc.ietf.org>, Dennis Jackson <ietf@dennis-jackson.uk>, TLS List <tls@ietf.org>
Thread-Topic: [TLS] Abridged Certificate Compression (server participation)
Thread-Index: Adm0dZ/UCHUKbS6cTLquRM0EcuJ9pw==
Date: Wed, 12 Jul 2023 04:02:09 +0000
Message-ID: <7bb0fe4f7d80488a926fee5ac18bb968@amazon.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
x-originating-ip: [10.37.240.200]
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Archived-At: <https://mailarchive.ietf.org/arch/msg/tls/XDtrTd7cwM62IGLvbGCQas4atvs>
Subject: [TLS] Abridged Certificate Compression (server participation)
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.39
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 12 Jul 2023 04:02:15 -0000

Hi Dennis,

One more topic for general discussion.

The abridged certs draft requires a server who participates and fetches dictionaries in order to make client connections faster. As Bas has pointed out before, this paradigm did not work well with OSCP staples in the past. Servers did not chose to actively participate and go fetch them. 

Are we confident that servers would deploy the dictionary fetching mechanism to benefit their connecting clients?

v2.46.0 | Report a Bug | By Email | System Status