IETF Logo Mail Archive

Re: [TLS] DTLS 1.3

Ilari Liusvaara <ilariliusvaara@welho.com> Tue, 05 July 2016 08:29 UTC

Return-Path: <ilariliusvaara@welho.com>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6636612B013 for <tls@ietfa.amsl.com>; Tue, 5 Jul 2016 01:29:27 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.82
X-Spam-Level:
X-Spam-Status: No, score=-1.82 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RP_MATCHES_RCVD=-1.426, SUBJ_ALL_CAPS=1.506] autolearn=no autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4wbE8V3xGZPC for <tls@ietfa.amsl.com>; Tue, 5 Jul 2016 01:29:25 -0700 (PDT)
Received: from welho-filter4.welho.com (welho-filter4.welho.com [83.102.41.26]) by ietfa.amsl.com (Postfix) with ESMTP id 477D912D0B4 for <tls@ietf.org>; Tue, 5 Jul 2016 01:29:24 -0700 (PDT)
Received: from localhost (localhost [127.0.0.1]) by welho-filter4.welho.com (Postfix) with ESMTP id 4C15C45C4; Tue, 5 Jul 2016 11:29:23 +0300 (EEST)
X-Virus-Scanned: Debian amavisd-new at pp.htv.fi
Received: from welho-smtp3.welho.com ([IPv6:::ffff:83.102.41.86]) by localhost (welho-filter4.welho.com [::ffff:83.102.41.26]) (amavisd-new, port 10024) with ESMTP id geydTCT9W2Wf; Tue, 5 Jul 2016 11:29:23 +0300 (EEST)
Received: from LK-Perkele-V2 (87-100-177-32.bb.dnainternet.fi [87.100.177.32]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by welho-smtp3.welho.com (Postfix) with ESMTPSA id 02CAB2315; Tue, 5 Jul 2016 11:29:23 +0300 (EEST)
Date: Tue, 05 Jul 2016 11:29:20 +0300
From: Ilari Liusvaara <ilariliusvaara@welho.com>
To: Eric Rescorla <ekr@rtfm.com>
Message-ID: <20160705082920.GA9700@LK-Perkele-V2.elisa-laajakaista.fi>
References: <577A38A2.2090209@gmx.net> <20160704140312.GC4287@LK-Perkele-V2.elisa-laajakaista.fi> <577ABCE2.9050409@gmx.net> <20160704204603.GA4837@LK-Perkele-V2.elisa-laajakaista.fi> <CABcZeBMYQ=SWfEwFVjpmO3Pzh78VTrdqXKF26TDnSA-nR-k=rQ@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Disposition: inline
In-Reply-To: <CABcZeBMYQ=SWfEwFVjpmO3Pzh78VTrdqXKF26TDnSA-nR-k=rQ@mail.gmail.com>
User-Agent: Mutt/1.6.0 (2016-04-01)
Sender: ilariliusvaara@welho.com
Archived-At: <https://mailarchive.ietf.org/arch/msg/tls/cXorYQDfuJO7BCndWMsVAhyxUcQ>
Cc: "tls@ietf.org" <tls@ietf.org>
Subject: Re: [TLS] DTLS 1.3
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.17
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 05 Jul 2016 08:29:27 -0000

On Mon, Jul 04, 2016 at 01:56:01PM -0700, Eric Rescorla wrote:
> 
> DTLS 1.3 should add an ACK, IMO.

Some quick napkin^Wtext editor sketch:

Handshake message type: acknowledge
- DTLS 1.3 only, not TLS 1.3.
- No retransmissions (transmitted once per trigger)
- Triggered if a complete flight is received with:
  * session_ticket message by client
  * certificate_request message by client and the client can't quickly
    produce the authentication block[1]
  * finished message by server.
- Contents:
  * Enumerated type:
    + SESSION_TICKET_RECEIVED
    + CERTIFICATE_REQUEST_IN_PROGRESS
    + CLIENT_FINISHED_RECEIVED
  * req_context: Certificate request context
    (CERTIFICATE_REQUEST_IN_PROGRESS only).


The certficate_request case could occur during the handshake, it then
would kill the server retransmit timer if received, having only the
client hold the retransmit (after it has finished assembling the
authentication block).


This design can probably be improved quite a bit.


[1] Including block that rejects the request.


-Ilari

v2.14.0 | Report a Bug | By Email