Re: [Unbearable] I-D Action: draft-ietf-tokbind-tls13-0rtt-02.txt

[Leif Johansson <[e-mail]>]

On 2017-06-29 04:48, Benjamin Kaduk wrote:
> On Wed, Jun 28, 2017 at 03:25:13PM -0700, Nick Harper wrote:
>> Here's a summary of the changes since the last draft:
>>
>> - If TB is accepted in 0-RTT data, keep using the early exporter for
>> the whole connection. There was some discussion on this in Chicago,
>> with more on the mailing list. Chairs, can you confirm whether we
>> reached consensus on the mailing list or whether we should take a hum
>> in Prague?
> 
> I am a WG chair, but not a tokbind chair, but that question does not
> seem to make sense.  Consensus must be reached (or confirmed) on the
> mailing list, so deciding there wasn't enough feedback on the list and
> going to an in-room hum seems backwards, procedurally.

Judging consensus is sometimes tricky. I think what Nick meant was that
we may want to do a hum in Prague /in addition to/ seeking confirmation
on the list.

> 
>> - 0-RTT TB cannot be used with externally provisioned PSKs or with a
>> PSK-only key exchange mode
>>
>> - A new TLS extension is used for negotiating and indicating use of 0-RTT TB
>>
>> - The replay indication TLS extension has been removed
> 
> Some discussion on the httpbis list brought up that this document should
> mandate that 0-RTT token binding is only used in conjunction with
> a TLS stack that provides strong anti-replay protections (i.e., zero
> additional replays possible and one retransmission via DKG attack).  In other
> words, the time-based scheme of (draft-02) section 6.4 should be removed,
> and perhaps 6.3.1 reworded somewhat.
> 
> (It also brought up multiple peoples' sentiments that 0-RTT token binding
> is a bad idea in general, but this may not be procedurally the right time
> to have that discussion.)
> 
> -Ben
>