MIME-Version: 1.0
References: <05B28816-9AA9-4035-B451-8ACFFBE2D4DE@apple.com>
 <CAChr6Sy1Eew1J5z9at3qEwLRWn+7ZLm0f564LobNQGMD7ANQaA@mail.gmail.com>
 <CABcZeBOpk2cYAyie4=G5=c6V43HvGB70fKVf_e_bQqnt_4C9WQ@mail.gmail.com>
 <CAF8qwaAoYEZj_t56unUAqz+SaKw6CvMFJ2NmqNmE8skmjKKSpA@mail.gmail.com>
In-Reply-To: 
 <CAF8qwaAoYEZj_t56unUAqz+SaKw6CvMFJ2NmqNmE8skmjKKSpA@mail.gmail.com>
From: Rob Sayre <sayrer@gmail.com>
Date: Mon, 17 Mar 2025 08:37:46 -0700
Message-ID: 
 <CAChr6Sw+9bZxjcaJMNbY8UZBbmv5ZDnyb7aGtCjXcrtxvfeoew@mail.gmail.com>
To: David Benjamin <davidben@chromium.org>
Content-Type: multipart/alternative; boundary="00000000000085f63b06308b920f"
Message-ID-Hash: M5QY74HNF7EZVP3MW5B4MRZXBWHZGJC3
CC: Laura Bauman <l_bauman=40apple.com@dmarc.ietf.org>, tls@ietf.org
Precedence: list
Subject: =?utf-8?q?=5BTLS=5D_Re=3A_Feedback_on_draft-bmw-tls-pake13-01=2Etxt?=
Archived-At: 
 <https://mailarchive.ietf.org/arch/msg/tls/svL-ZO3JCNIevWu-iVga41cIeZw>

--00000000000085f63b06308b920f
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Sun, Mar 16, 2025 at 7:52=E2=80=AFPM David Benjamin <davidben@chromium.o=
rg>
wrote:

>
> I'd also add that, *if* we want something PAKE-shaped in a web-like
> context, I don't think TLS-PAKE is a good fit for it. (Which is fine! Not
> everything needs to be for every use case.)
>

Yes, I was thinking of mobile phone sign-in use cases. I think web browsers
could also offer "native" sign-in UI for people that want to use it. It
wouldn't be much different from my bank iOS app that lets me sign in with
FaceID. This kind of thing:

https://developer.apple.com/documentation/sign_in_with_apple/authenticating=
-users-with-sign-in-with-apple


Couldn't it be click "Sign In", and start the TLS key schedule from there,
>>> instead of "0"? No extensions necessary.
>>>
>>
>> Regardless of the point above, I do not believe this would work. You nee=
d
>> some protocol to carry the PAKE information and if that's not going in t=
he
>> TLS handshake, where is it going?
>>
>
Oh, right. I had some scheme to carry it in another extension (I think I
tried a few) with the aim of "Do Not Stick Out", but it occurs to me that,
these days, you could put these only inside the ECH ClientHelloInner if you
don't want it to be obvious that you're using a PAKE.

thanks,
Rob

--00000000000085f63b06308b920f
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div dir=3D"ltr">On Sun, Mar 16, 2025 at 7:52=E2=80=AFPM D=
avid Benjamin &lt;<a href=3D"mailto:davidben@chromium.org">davidben@chromiu=
m.org</a>&gt; wrote:<br></div><div class=3D"gmail_quote gmail_quote_contain=
er"><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;bor=
der-left-width:1px;border-left-style:solid;border-left-color:rgb(204,204,20=
4);padding-left:1ex"><div dir=3D"ltr"><div dir=3D"ltr"><div dir=3D"ltr"><di=
v class=3D"gmail_quote"><div><br></div><div>I&#39;d also add that, <i>if</i=
>=C2=A0we want something PAKE-shaped in a web-like context, I don&#39;t thi=
nk TLS-PAKE is a good fit for it. (Which is fine! Not everything needs to b=
e for every use case.)</div></div></div></div></div></blockquote><div><br><=
/div><div>Yes, I was thinking of mobile phone sign-in use cases. I think we=
b browsers could also offer &quot;native&quot; sign-in UI for people that w=
ant to use it. It wouldn&#39;t be much different from my bank iOS app that =
lets me sign in with FaceID. This kind of thing:</div><div><br></div><div><=
a href=3D"https://developer.apple.com/documentation/sign_in_with_apple/auth=
enticating-users-with-sign-in-with-apple">https://developer.apple.com/docum=
entation/sign_in_with_apple/authenticating-users-with-sign-in-with-apple</a=
><br></div><div><br></div><div><br></div><blockquote class=3D"gmail_quote" =
style=3D"margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:s=
olid;border-left-color:rgb(204,204,204);padding-left:1ex"><div dir=3D"ltr">=
<div dir=3D"ltr"><div dir=3D"ltr"><div class=3D"gmail_quote"><blockquote cl=
ass=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left-width:1px=
;border-left-style:solid;border-left-color:rgb(204,204,204);padding-left:1e=
x"><div dir=3D"ltr"><div class=3D"gmail_quote"><div></div><blockquote class=
=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left-width:1px;bo=
rder-left-style:solid;border-left-color:rgb(204,204,204);padding-left:1ex">=
<div dir=3D"ltr"><div dir=3D"ltr"><div dir=3D"ltr"><div class=3D"gmail_quot=
e"><div>Couldn&#39;t it be click &quot;Sign In&quot;, and start the TLS key=
 schedule from there, instead of &quot;0&quot;? No extensions necessary.</d=
iv></div></div></div></div></blockquote><div><br></div><div>Regardless of t=
he point above, I do not believe this would work. You need some protocol to=
 carry the PAKE information and if that&#39;s not going in the TLS handshak=
e, where is it going?</div></div></div></blockquote></div></div></div></div=
></blockquote><div><br></div><div>Oh, right. I had some scheme to carry it =
in another extension (I think I tried a few) with the aim of &quot;Do Not S=
tick Out&quot;, but it occurs to me that, these days, you could put these o=
nly inside the ECH=C2=A0ClientHelloInner if you don&#39;t want it to be obv=
ious that you&#39;re using a PAKE.</div><div><br></div><div>thanks,</div><d=
iv>Rob</div><div><br></div></div></div>

--00000000000085f63b06308b920f--