IETF Logo Mail Archive

Re: [TLS] Security review of TLS1.3 0-RTT

Colm MacCárthaigh <colm@allcosts.net> Tue, 02 May 2017 18:18 UTC

Return-Path: <colm@allcosts.net>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CFBEA129C0B for <tls@ietfa.amsl.com>; Tue, 2 May 2017 11:18:19 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: 0
X-Spam-Level:
X-Spam-Status: No, score=0 tagged_above=-999 required=5 tests=[BAYES_40=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=allcosts-net.20150623.gappssmtp.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KiyI_2CSIVvw for <tls@ietfa.amsl.com>; Tue, 2 May 2017 11:18:18 -0700 (PDT)
Received: from mail-yb0-x22f.google.com (mail-yb0-x22f.google.com [IPv6:2607:f8b0:4002:c09::22f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9CF65127868 for <tls@ietf.org>; Tue, 2 May 2017 11:15:07 -0700 (PDT)
Received: by mail-yb0-x22f.google.com with SMTP id 8so37009671ybw.1 for <tls@ietf.org>; Tue, 02 May 2017 11:15:07 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=allcosts-net.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to; bh=EftiTaJwacr+bNj6nfmQ/LtnN9J8LbD0kGi9BWdCAcI=; b=XwuIfrzwrE47WKwvFdibiZ0eaKZc8FDvCL3tP8lrJqNXQwj0zhzeZ4Mza+tZR/I1xH VYhjb4p2AUw1tvXyGQC2/DuBugWfaHniw4SVyYoNQIY5bLgTgRpF5EwlWS8tGCQE5/uN pHJGEf3gefZYaoxn+pLGZAiVXo9ycYSs8ZZhkSW0r3pMWSN9JWwJhtVdml9SRsWHrL1r DqqlWNTZUfuK8sSJFh0ocP03qQ4KGY+dZTBZs+UPx1fLoAxwbQpJr7pbtdzDAtfde5+G TSNMzSEBF4Tc0Bbqa/bm9yBkKDnQgA/wNPfsdzifrV8RaDcfnAHVgJqYeYLmWbInecM6 ChhQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to; bh=EftiTaJwacr+bNj6nfmQ/LtnN9J8LbD0kGi9BWdCAcI=; b=i++6woihwNFU5EvLrgD1KO/aU40d8pgcLDbpwHExAqpHklIz2WA4kJ3nCsLdMn7qed AZfHh92I3WcsVLIOzL1a7yhktMDQb9LdEgw2vQhWUutCC+R3SslWw0ZBFz9Fapvv9iPb snjhZ3pNnCvqozCUyBwTDZ0jVKrzC2zUkxQs1MrM5bpKorISiTblRLzZAt6yoBhowXRV aDnNKRuHV1wDsHHVerhCM+erDZaIgTRk55Gwn281DbSi263puq2+CrL4A7IiV0L5QcgZ rfeLu9bYuocu3duQaKEEcLK/588O0EWiNpWjM6+VZbEMPiPbrLOlIehoQXOnPSFIOkbG vvYg==
X-Gm-Message-State: AN3rC/5Xb0fj0RXyhLRaCAd76JZopojzTfUiGbTtH8eGMmvTwY6vxCXM 8iH/FqmWGvR9qPKxQcfBdsTp9avtfw==
X-Received: by 10.37.15.213 with SMTP id 204mr68022ybp.127.1493748906793; Tue, 02 May 2017 11:15:06 -0700 (PDT)
MIME-Version: 1.0
Received: by 10.129.57.67 with HTTP; Tue, 2 May 2017 11:15:06 -0700 (PDT)
In-Reply-To: <D08E24E8-076F-4182-8A55-19CD801FF07B@dukhovni.org>
References: <CAAF6GDcKZj9F-eKAeVj0Uw4aX_EgQ4DuJczL4=fsaFyG9Yjcgw@mail.gmail.com> <C29356B3-6D71-4088-9AB3-4954327F1E7B@dukhovni.org> <CAAF6GDdwes+A1XhibBTJFnAM8Fa4V2HD2vjqdF0eNhiFTwaRGA@mail.gmail.com> <D08E24E8-076F-4182-8A55-19CD801FF07B@dukhovni.org>
From: Colm MacCárthaigh <colm@allcosts.net>
Date: Tue, 02 May 2017 11:15:06 -0700
Message-ID: <CAAF6GDe6=NB4uD2qB6tT=DHYXFXBrWn0ZFy=0p32SoAGvmpA2w@mail.gmail.com>
To: TLS WG <tls@ietf.org>
Content-Type: multipart/alternative; boundary="001a113f5ae6f95e42054e8e8488"
Archived-At: <https://mailarchive.ietf.org/arch/msg/tls/uZk3-vFI3jVfvK-Ynaw_ti3mXGA>
Subject: Re: [TLS] Security review of TLS1.3 0-RTT
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 02 May 2017 18:18:20 -0000

On Tue, May 2, 2017 at 11:08 AM, Viktor Dukhovni <ietf-dane@dukhovni.org>
wrote:

> Yes, if the change is narrowly tailored to 0-RTT, *and* if server TLS
> stacks
> don't stop supporting ticket reuse for "normal" (not 0-RTT) sessions, then
> I have no direct concerns with changes that affect 0-RTT alone.
>

Great - I added a small errata comment on the github issue just recording
that too.

In that case, I only reason I see to stop using tickets multiple times is
to protect the obfuscated age. It reads to me like its purpose would just
be defeated. Is it really that hard for clients to use a 1-for-1
use-a-ticket-get-a-ticket approach?

-- 
Colm

v2.23.0 | Report a Bug | By Email