Re: [Unbearable] I-D Action: draft-ietf-tokbind-tls13-0rtt-02.txt

[Benjamin Kaduk <[e-mail]>]

On Wed, Jun 28, 2017 at 03:25:13PM -0700, Nick Harper wrote:
> Here's a summary of the changes since the last draft:
> 
> - If TB is accepted in 0-RTT data, keep using the early exporter for
> the whole connection. There was some discussion on this in Chicago,
> with more on the mailing list. Chairs, can you confirm whether we
> reached consensus on the mailing list or whether we should take a hum
> in Prague?

I am a WG chair, but not a tokbind chair, but that question does not
seem to make sense.  Consensus must be reached (or confirmed) on the
mailing list, so deciding there wasn't enough feedback on the list and
going to an in-room hum seems backwards, procedurally.

> - 0-RTT TB cannot be used with externally provisioned PSKs or with a
> PSK-only key exchange mode
> 
> - A new TLS extension is used for negotiating and indicating use of 0-RTT TB
> 
> - The replay indication TLS extension has been removed

Some discussion on the httpbis list brought up that this document should
mandate that 0-RTT token binding is only used in conjunction with
a TLS stack that provides strong anti-replay protections (i.e., zero
additional replays possible and one retransmission via DKG attack).  In other
words, the time-based scheme of (draft-02) section 6.4 should be removed,
and perhaps 6.3.1 reworded somewhat.

(It also brought up multiple peoples' sentiments that 0-RTT token binding
is a bad idea in general, but this may not be procedurally the right time
to have that discussion.)

-Ben