IETF Logo Mail Archive

Re: [TLS] I-D Action: draft-ietf-tls-certificate-compression-01.txt

Ilari Liusvaara <ilariliusvaara@welho.com> Mon, 11 December 2017 15:00 UTC

Return-Path: <ilariliusvaara@welho.com>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 75DAF126D0C for <tls@ietfa.amsl.com>; Mon, 11 Dec 2017 07:00:21 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.89
X-Spam-Level:
X-Spam-Status: No, score=-1.89 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, T_SPF_HELO_TEMPERROR=0.01] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0tYHKb2YinKo for <tls@ietfa.amsl.com>; Mon, 11 Dec 2017 07:00:20 -0800 (PST)
Received: from welho-filter1.welho.com (welho-filter1.welho.com [83.102.41.23]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 050A7126B71 for <tls@ietf.org>; Mon, 11 Dec 2017 07:00:20 -0800 (PST)
Received: from localhost (localhost [127.0.0.1]) by welho-filter1.welho.com (Postfix) with ESMTP id 4252953726; Mon, 11 Dec 2017 17:00:18 +0200 (EET)
X-Virus-Scanned: Debian amavisd-new at pp.htv.fi
Received: from welho-smtp1.welho.com ([IPv6:::ffff:83.102.41.84]) by localhost (welho-filter1.welho.com [::ffff:83.102.41.23]) (amavisd-new, port 10024) with ESMTP id shEOzFjmkBpG; Mon, 11 Dec 2017 17:00:18 +0200 (EET)
Received: from LK-Perkele-VII (87-92-19-27.bb.dnainternet.fi [87.92.19.27]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by welho-smtp1.welho.com (Postfix) with ESMTPSA id D59BB27F; Mon, 11 Dec 2017 17:00:15 +0200 (EET)
Date: Mon, 11 Dec 2017 17:00:15 +0200
From: Ilari Liusvaara <ilariliusvaara@welho.com>
To: Martin Thomson <martin.thomson@gmail.com>
Cc: "tls@ietf.org" <tls@ietf.org>
Message-ID: <20171211150015.GB5741@LK-Perkele-VII>
References: <151282209956.24790.5482932813219061171@ietfa.amsl.com> <20171209123023.GA8296@pinky> <CABkgnnUdKJZ++dV_Vc1jGFpieAvAqVq=H8+1uB_NkNeSgLys-Q@mail.gmail.com> <20171211060935.GA4599@LK-Perkele-VII> <CABkgnnUvbinYQK1NsQJoZQYM98PiSZRBfWYRn57jbqUDY+fr4w@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Disposition: inline
In-Reply-To: <CABkgnnUvbinYQK1NsQJoZQYM98PiSZRBfWYRn57jbqUDY+fr4w@mail.gmail.com>
User-Agent: Mutt/1.9.1 (2017-09-22)
Sender: ilariliusvaara@welho.com
Archived-At: <https://mailarchive.ietf.org/arch/msg/tls/rFdH6_WBzSkqXKoEYMqLsXee8nA>
Subject: Re: [TLS] I-D Action: draft-ietf-tls-certificate-compression-01.txt
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 11 Dec 2017 15:00:21 -0000

On Mon, Dec 11, 2017 at 08:50:17AM -0600, Martin Thomson wrote:
> On Mon, Dec 11, 2017 at 12:09 AM, Ilari Liusvaara
> <ilariliusvaara@welho.com> wrote:
> > Transforming messages before putting them in transcript? That sounds
> > like recipe for some very nasty implementation headaches.
> >
> > AFAIK, nothing else in TLS does this. TLS 1.3 has reset hash and inject
> > synthetic message, but that is a lot easier than actual message
> > transformation.
> 
> My understanding is that this is what is proposed.  FWIW, it's not
> that awful for us to implement in NSS.

I searched the drafts (both -00 and -01). I find absolutely nothing
to suggest this extension would play any games with the handshake
hash. And considering that extension playing such games is AFAIK
unprecidented, that would warrant rather big warnings.


-Ilari

v2.23.0 | Report a Bug | By Email