Re: [TLS] [sasl] lasgt call comments (st Call: draft-altman-tls-channel-bindings (Channel Bindings for TLS) to Proposed Standard)

Nicolas Williams <Nicolas.Williams@sun.com> Wed, 28 October 2009 16:11 UTC

Return-Path: <Nicolas.Williams@sun.com>
X-Original-To: tls@core3.amsl.com
Delivered-To: tls@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 28BD83A6858; Wed, 28 Oct 2009 09:11:28 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -5.985
X-Spam-Level:
X-Spam-Status: No, score=-5.985 tagged_above=-999 required=5 tests=[AWL=0.061, BAYES_00=-2.599, HELO_MISMATCH_COM=0.553, RCVD_IN_DNSWL_MED=-4]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id eZUegWPx01qm; Wed, 28 Oct 2009 09:11:27 -0700 (PDT)
Received: from sca-ea-mail-2.sun.com (sca-ea-mail-2.Sun.COM [192.18.43.25]) by core3.amsl.com (Postfix) with ESMTP id 5B24D3A6847; Wed, 28 Oct 2009 09:11:27 -0700 (PDT)
Received: from dm-central-01.central.sun.com ([129.147.62.4]) by sca-ea-mail-2.sun.com (8.13.7+Sun/8.12.9) with ESMTP id n9SGBe3t009036; Wed, 28 Oct 2009 16:11:40 GMT
Received: from binky.Central.Sun.COM (binky.Central.Sun.COM [129.153.128.104]) by dm-central-01.central.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id n9SGBeuK042429; Wed, 28 Oct 2009 10:11:40 -0600 (MDT)
Received: from binky.Central.Sun.COM (localhost [127.0.0.1]) by binky.Central.Sun.COM (8.14.3+Sun/8.14.3) with ESMTP id n9SG0EOb002442; Wed, 28 Oct 2009 11:00:14 -0500 (CDT)
Received: (from nw141292@localhost) by binky.Central.Sun.COM (8.14.3+Sun/8.14.3/Submit) id n9SG0DF4002441; Wed, 28 Oct 2009 11:00:13 -0500 (CDT)
X-Authentication-Warning: binky.Central.Sun.COM: nw141292 set sender to Nicolas.Williams@sun.com using -f
Date: Wed, 28 Oct 2009 11:00:13 -0500
From: Nicolas Williams <Nicolas.Williams@sun.com>
To: Larry Zhu <larry.zhu@microsoft.com>
Message-ID: <20091028160013.GL1105@Sun.COM>
References: <20091005162704.8C1B43A6873@core3.amsl.com> <D3DC9D45B39CFC4CB312B2DD279B354C29BAE0E5@TK5EX14MBXW653.wingroup.windeploy.ntdev.microsoft.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <D3DC9D45B39CFC4CB312B2DD279B354C29BAE0E5@TK5EX14MBXW653.wingroup.windeploy.ntdev.microsoft.com>
User-Agent: Mutt/1.5.7i
Cc: "channel-binding@ietf.org" <channel-binding@ietf.org>, "tls@ietf.org" <tls@ietf.org>, "sasl@ietf.org" <sasl@ietf.org>
Subject: Re: [TLS] [sasl] lasgt call comments (st Call: draft-altman-tls-channel-bindings (Channel Bindings for TLS) to Proposed Standard)
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/tls>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 28 Oct 2009 16:11:28 -0000

On Wed, Oct 28, 2009 at 10:18:04AM +0000, Larry Zhu wrote:
> There is a design issue in tls-unique. For vendors who implement TLS
> in a separate library, the TLS library does not by itself control the
> transport therefore it would not know if there is a new connection, so
> that the current specification is not implementable for these vendors.
> 
> It would be much easier to say the following instead:
> 
> The client's TLS Finished message from the first handshake of the
> session (note: TLS session, not connection, so that the channel
> binding is specific to each TLS session regardless of whether session
> resumption is used).
> 
> And the updated text does reflect what has been deployed for
> tls-unique.  
> 
> I would like to raise a red flag now. Needless to say that I will
> start a discussion with the responsible AD and the rest of the editors
> of this ID to fix this issue, and do so based on consensus. 
> 
> Pasi, please consider this issue blocking for now.

Larry,

It's hard to parse your message because the words "connection" and
"transport" have multiple possible meanings in this context.

In any case we've discussed this before, and the _current_ text is what
we reached consensus on earlier.  I believe the current text says what I
think you meant to say, in your e-mail.

Nico
--