RE: [TLS] Stateless TLS Session Resumption extension and EAP-FAST.

We have submitted a draft for an RFC4507bis to correct this problem.  It
can be found at 

http://www.ietf.org/internet-drafts/draft-salowey-tls-rfc4507bis-00.txt

Please take this opportunity to review the draft correction as we would
like to submit the draft for publication soon.

Thanks,

Joe

> -----Original Message-----
> From: Joseph Salowey (jsalowey) 
> Sent: Monday, March 05, 2007 2:18 PM
> To: Jan Nordqvist; tls@ietf.org
> Subject: RE: [TLS] Stateless TLS Session Resumption extension 
> and EAP-FAST.
> 
> Hi Jan,
> 
> You are correct, there is an issue with current 
> implementation.  Thanks for pointing this out.  Details follow:
> 
> Current EAP-FAST implementations do not format the extension 
> correctly as to spec.  They leave out one of the length fields.
> 
> EAP-FAST implementation:
> 
>       struct {
>   	   uint16 extensionType 	
>  	   opaque ticket<0..2^16-1>
>       } SessionTicketExtension
> 
> Example encoding: 00 23 LL LL TT TT TT ...
> 
> LL - ticket length
> TT - ticket
> 
> RFC4507:
> 
> >     struct {
> >        opaque ticket<0..2^16-1>;
> >     } SessionTicket;
> >
> >    struct {
> >  	   uint16 extensionType 	
> > 	   opaque SessionTicket<0..2^16-1>
> >    } SessionTicketExtension
> >
> 
> Example encoding: 00 23 LN LN LL LL TT TT TT....
> 
> LN - length of ticket + 2-bytes
> 
> Joe 
> 
> > -----Original Message-----
> > From: Jan Nordqvist [mailto:jnordqvist@alcatel-lucent.com]
> > Sent: Thursday, March 01, 2007 11:52 AM
> > To: tls@ietf.org
> > Subject: [TLS] Stateless TLS Session Resumption extension and 
> > EAP-FAST.
> > 
> > I apologize if this gets duplicated, I had the wrong address
> > registered:
> > 
> > During some recent work incorporating EAP-FAST support into our TLS 
> > stack I have discovered that the devices we use for testing are 
> > violating the format of the stateless session ticket extension 
> > definition per RFC-4507. In all instances I have seen, the whole 
> > SessionTicket is preceded by a two-byte 'type' field, i.e. the 
> > definition is really
> > 
> > struct {
> >     uint16 type;
> >     opaque ticket<0..2^16-1>;
> > } SessionTicket;
> > 
> > I don't know the size of deployments of EAP-FAST devices 
> versus other 
> > implementations using the session ticket extension, but it 
> seems that 
> > either RFC-4507 needs to be updated to reflect what is actually 
> > implemented or perhaps the extension should be split into two.
> > 
> > Regards,
> > Jan Nordqvist
> > 
> > 
> > _______________________________________________
> > TLS mailing list
> > TLS@lists.ietf.org
> > https://www1.ietf.org/mailman/listinfo/tls
> > 
> 
> _______________________________________________
> TLS mailing list
> TLS@lists.ietf.org
> https://www1.ietf.org/mailman/listinfo/tls
> 

_______________________________________________
TLS mailing list
TLS@lists.ietf.org
https://www1.ietf.org/mailman/listinfo/tls