Re: [TLS] Comments on various things on agenda (Was: Re: TLS Interim - update and agenda)

[Ilari Liusvaara <[e-mail]>]

On Wed, Mar 11, 2015 at 08:16:53AM -0700, Watson Ladd wrote:
> On Mar 10, 2015 10:19 PM, "Peter Gutmann" <[e-mail]> wrote:
> >
> > (and many others).  It's already so different even to TLS 1.2 that
> there's no
> > point in retaining some crufty old artefact of SSL 3.0 just because we've
> > always done it this way.  If there's a feature that's useful or important
> to
> > the functioning of the protocol then by all means include it, but there's
> no
> > point in dragging along old protocol misfeatures "for backwards
> compatibility"
> > when so much else has changed incompatibly.
> 
> I agree. We should focus in simplifying implementations of TLS 1.3 and TLS
> 1.2, and it seems that this means assuming minimal (read none)  code reuse,
> and focusing on simplifying TLS 1.3 on its own terms.

The kind of backward compatiblity I am talking about:
- Be able to do secure downnegotiation to TLS 1.2.
- Don't break protocols using TLS.


These would impose the following constraints:
- The first flight can only have TLS 1.2-compatible ClientHello (unless
  server is known to be 1.3-capable and client is prepared to take
  heavy latencies otherwise).
- The second flight has to be always distinguishable from TLS 1.2.
  (recordversion field should do here?)
- Not using record types (first byte of record) outside 20-63 range.
- TLS-Unique and TLS-Exporter APIs are still there.


The following are examples of changes outside scope of backwards compat:
- Removing recordversion from encrypted records.
- Redefining recordtype values (within range, some of that already done).
- Redefining TLS-Unique and TLS-Exporter internals.
- Totally rearranging the handshake (already done)


Also, to me the current TLS 1.3 draft looks to be much more hardened
against cryptographic attacks than TLS 1.2 (even with session_hash).
And the source of this resistance is precisely encrypting as much as
possible together with CRK.


-Ilari