Re: [TLS] TLS 1.3 draft-07 sneak peek

[Eric Rescorla <[e-mail]>]

On Tue, Jun 30, 2015 at 6:31 PM, Dave Garrett <[e-mail]>
wrote:

> On Tuesday, June 30, 2015 06:23:18 pm Eric Rescorla wrote:
> > 2. Should we require that PSK cipher suites where the PSK is used for
> > resumption use compatible ciphers?
>
>
> https://github.com/tlswg/tls13-spec/compare/master...ekr:WIP_draft_07#diff-9d84740dcc569a0a5a359d0fba461a05R3037
> +After the server has received the client Finished message, it MAY send
> +a NewSessionTicket message. This message creates a pre-shared key
> +(PSK) binding between the resumption master secret and the ticket
> +label. The client MAY use this PSK for future handshakes by including
> +it in the pre_shared_key extension in its ClientHello
> +({{pre-shared-key-extension}}) and supplying a suitable PSK cipher
> +suite.
> +
> +%%% Ticket Establishment
> +      struct {
> +          uint32 ticket_lifetime_hint;
> +          opaque ticket<0..2^16-1>;
> +      } NewSessionTicket;
>
> The "suitable PSK cipher suite" & "resumption use compatible ciphers"
> issues would be simpler if the NewSessionTicket was just bound to a
> specified cipher suite (or vector of suites, but that's probably not
> needed). We could just add a cipher suite field here so the server tells
> the client exactly what it expects.


Yes, that's one possibility.

-Ekr


>
> Dave
>