User-Agent: Cyrus-JMAP/3.3.0-dev0-519-g0f677ba-fm-20200601.001-g0f677ba6
Mime-Version: 1.0
Message-Id: <67c0d137-b5ae-4fb5-bc42-d68726e082d8@www.fastmail.com>
In-Reply-To: <466C44E4-2416-4FE2-AED0-F7DBE1EEFB21@vigilsec.com>
References: <20200604000011.387A5F4070F@rfc-editor.org>
 <73b5d3e2-d2f4-447c-84d6-0ae0a08374a9@www.fastmail.com>
 <CABcZeBMswqW4rWGmTxwK_zUy0-anRt6PFPo_YK1zNhWQw7wtSg@mail.gmail.com>
 <F3357894-3045-44A9-B30E-8AD2DEB37DE6@vigilsec.com>
 <CABcZeBOmRAFV9M1W6bmD8OCFcDpQmC+5M=4reRzMhjnpPHC4dg@mail.gmail.com>
 <070E5A6D-7D2F-405A-B5D8-8C90379306D9@vigilsec.com>
 <CABcZeBP8hmBdNdxpiVJ_rnub4TnOCOVLm+D7yGBotSQDoU9g3Q@mail.gmail.com>
 <466C44E4-2416-4FE2-AED0-F7DBE1EEFB21@vigilsec.com>
Date: Tue, 09 Jun 2020 10:55:40 +1000
From: "Martin Thomson" <mt@lowentropy.net>
To: "Russ Housley" <housley@vigilsec.com>, "'Eric Rescorla'" <ekr@rtfm.com>
Cc: "IETF TLS" <tls@ietf.org>
Content-Type: text/plain
Archived-At: <https://mailarchive.ietf.org/arch/msg/tls/lf-24GHrdCD7bpoYFporGLBuV-A>
Subject: Re: [TLS] [Editorial Errata Reported] RFC8446 (6204)
Precedence: list

On Fri, Jun 5, 2020, at 03:54, Russ Housley wrote:
> > On Jun 4, 2020, at 12:37 PM, Eric Rescorla <ekr@rtfm.com> wrote:
> > Changing:
> >  TLS 1.3 does not permit the server to send a CertificateRequest
> >  message when a PSK is being used. This restriction is removed when
> >  the "tls_cert_with_extern_psk" extension is negotiated, allowing
> >  certificate-based authentication for both the client and the
> >  server. To: TLS 1.3 does not permit the server to send a
> >  CertificateRequest message when a PSK is being used. This restriction
> >  is removed when the "tls_cert_with_extern_psk" extension is
> >  negotiated, allowing certificate-based authentication for both the
> >  client and the server.
> > 
> > To:
> >  TLS 1.3 does not permit the server to send a CertificateRequest
> >  message when a PSK is being used. This restriction is removed when
> >  the "tls_cert_with_extern_psk" extension is negotiated, allowing
> >  certificate-based authentication for both the client and the
> >  server. To: TLS 1.3 does not permit the server to send a
> >  CertificateRequest message when a PSK is being used. This
> >  restriction is removed for the main handshake when the
> >  "tls_cert_with_extern_psk" extension is negotiated, allowing
> >  certificate-based authentication for both the client and the
> >  server. This extension has no impact on external PSK usage
> >  with post-handshake authentication, which is prohibited by
> >  TLS 1.3.

I see four copies of nearly the same text here, I just want to confirm that it is this last one that we are talking about:

> TLS 1.3 does not permit the server to send a CertificateRequest message when a PSK is being used. This restriction is removed for the main handshake when the "tls_cert_with_extern_psk" extension is negotiated, allowing certificate-based authentication for both the client and the server. This extension has no impact on external PSK usage with post-handshake authentication, which is prohibited by TLS 1.3.

> This works for me. I wonder if "initial handshake" would be better than 
> "main handshake"

"initial" or "main" both add confusion here, I would strike the qualification.  In TLS, there is only one handshake.

If you want to talk about use of a resumption PSK in this context, then maybe add another sentence that highlights the fact that a resumption PSK that is created from a connection that uses "tls_cert_with_extern_psk" can be used, but the resulting handshake cannot involve a CertificateRequest, though a post-handshake CertificateRequest is permitted.