Re: [TLS] WGLC for draft-ietf-tls-ticketrequests

Viktor Dukhovni <ietf-dane@dukhovni.org> Wed, 20 November 2019 03:48 UTC

Return-Path: <ietf-dane@dukhovni.org>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9E840120236 for <tls@ietfa.amsl.com>; Tue, 19 Nov 2019 19:48:15 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -4.2
X-Spam-Level:
X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id kf8-o6748cg6 for <tls@ietfa.amsl.com>; Tue, 19 Nov 2019 19:48:13 -0800 (PST)
Received: from straasha.imrryr.org (straasha.imrryr.org [100.2.39.101]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 686AB120232 for <tls@ietf.org>; Tue, 19 Nov 2019 19:48:13 -0800 (PST)
Received: by straasha.imrryr.org (Postfix, from userid 1001) id A03EB331A79; Tue, 19 Nov 2019 22:48:12 -0500 (EST)
Date: Tue, 19 Nov 2019 22:48:12 -0500
From: Viktor Dukhovni <ietf-dane@dukhovni.org>
To: tls@ietf.org
Message-ID: <20191120034812.GQ34850@straasha.imrryr.org>
Reply-To: tls@ietf.org
References: <caa6f6b4-537c-46bb-a04b-28d2b59f8ecd@www.fastmail.com> <20191116100546.GP34850@straasha.imrryr.org> <20191116103855.GQ20609@akamai.com> <20191116110425.GR34850@straasha.imrryr.org> <556d2210-4af7-b398-fbd7-eab2685d7c62@wizmail.org> <20191116210617.GS34850@straasha.imrryr.org> <20191116235952.GR20609@akamai.com> <20191117002249.GV34850@straasha.imrryr.org> <CADZyTkmaUVj=sFdgg93MuM2au0B=1M1k3yCA1XDoaAneVDmnNw@mail.gmail.com> <14690874-E301-4BC0-B385-00DEBCBA94C2@apple.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <14690874-E301-4BC0-B385-00DEBCBA94C2@apple.com>
User-Agent: Mutt/1.12.1 (2019-06-15)
Archived-At: <https://mailarchive.ietf.org/arch/msg/tls/yI-8RHzwoWYuvIUoAOeNuhyzUVY>
Subject: Re: [TLS] WGLC for draft-ietf-tls-ticketrequests
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 20 Nov 2019 03:48:15 -0000

On Wed, Nov 20, 2019 at 10:40:20AM +0800, Tommy Pauly wrote:

> >     - 0x01-0xfe => client wants single-use tickets:
> >         + send up to that many tickets on full handshake,
> >         + however, generally send just 1 ticket on resumption, or when
> >           replacing tickets during long-lived connections.  This helps to
> >           reduce chronic ticket "oversupply".
> 
> Having a recommendation to generally just send one ticket

You left out the key qualification: "on resumption".  Now perhaps
that strategy is only needed in the *absence* of any signal from
the client, and with the extension the onus is perhaps on the client
to send "1" once it has enough tickets, in which case the server
does not need to apply the heuristic that helps it to avoid chronic
ticket oversupply.  In which case, the "generally send just 1" can
be left out, it is a side comment, not essential to the overall
proposal.

Somebody should try to avoid ending up with N new tickets after
every connection, but in could well be the client.

> doesn't address the motivating use case for the document, which is Happy
> Eyeballs (connection racing). Having multiple tickets is required in a steady
> state, so we shouldn't recommend against that.
> 
> Any client that wants to only do the reuse case can just not use this extension.

No, the extension is *very* useful to such clients, to signal to the server
that that's what they want to do, so that the server then only issues new
tickets when necessary.

-- 
    Viktor.