Re: [TLS] Adoption call for draft-sy-tls-resumption-group

Hello everyone,

I believe that the problem this draft addresses is important, and I believe
the working group should take on this work.

For various operational reasons, websites often use different IPs for
different resources they need to fetch.  Resumption across different SNI
values could allow them to use 0-RTT, reducing penalty for new connections
they have to make.

A particular case I want to address is a situation when there is a CDN (say
cdn.example.com) that has multiple shards (say shard101.cdn.example.com and
shard102.cdn.example.com), and the client gets load balanced to a specific
shard based on requested resource.  In the current situation, unless
shard101 and shard102 share the same physical IP, they'd have to pay
connection startup cost for each request.  Cross-domain resumption would
allow 0-RTT to the second shard accessed, provided all shards have a
wildcard certificate.

>From the technical standpoint, I agree with Martin that a NewSessionTicket
extension would be a better fit, but this is something that we can figure
out later without much trouble.

The policy questions (when *should* the client resume?) are more difficult
here, and there are multiple aspects to this.  One is, as Martin pointed
out, is clarifying the notion of server identity from application
perspective in cross-domain scenario.  Another is ensuring that the
linkability properties are not altered in ways we don't understand.  On the
surface, one can argue that this is semantically the same procedure as
HTTP/2 connection pooling, but without the IP match requirement.  This is
good, because we can build on the analysis of an existing mechanism.
Still, in practice, this might open us up to attacks that with the IP match
were impractical.  We should ensure that the document describes things
we've learned from connection pooling, too.

As I've said before, I am happy to help with this draft.

  -- Victor.

On Fri, Apr 12, 2019 at 7:36 PM Christopher Wood <caw@heapingbits.net>
wrote:

> At TLS@IETF104, there was interest in the room to adopt
> draft-sy-tls-resumption-group as a WG item. The draft can be found here:
>
>     https://datatracker.ietf.org/doc/draft-sy-tls-resumption-group/
>
> This email starts the call for adoption. It will run until April 26, 2019.
> Please indicate whether or not you would like to see this draft
> adopted.
>
> Thanks,
> Chris, Joe, and Sean
>
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls
>