Subject: Re: Working Group Last Call for Using Early Data in HTTP

From: Jeffrey Yasskin <[email-masked]>
Date: Tue, 13 Feb 2018 00:24:30 +0000

I apologize for sending this so long after the WGLC deadline, but I noticed
that draft-ietf-httpbis-replay-02, "Using Early Data in HTTP", doesn't
mention the risks of sending non-PFS early data.

Even in requests that pose no replay risks, the client might include
confidential data like cookies, or the fact of requesting a particular path
might be private. If an expired key is discovered by an attacker, my
understanding is that they could decrypt this information if it's sent in
early data. Is that right?

If so, do clients need to restrict their early-data requests to ones not
containing confidential information? (I think, for browsers, that would be
requests with an "omit" credentials mode:
https://fetch.spec.whatwg.org/#concept-request-credentials-mode.) Should
private-browsing modes avoid early-data entirely? Should all browsing modes
restrict it to cases where they have evidence that the request data isn't
private?

Thanks,
Jeffrey

On Thu, Nov 23, 2017 at 6:54 PM Patrick McManus <[email-masked]>
wrote:

> Hi All - When we met in Singapore we discussed a couple final details of
> the Early Data / Replay draft and indicated we would start WGLC after a
> final(?) update. The authors have made that update and we're ready for the
> LC now.
>
> Please have a look at:
> https://tools.ietf.org/html/draft-ietf-httpbis-replay-02
>
> Raise any issues either on the mailing list or in the issues list.
> Statements of support, implementation, or intent to implement to the list
> would also be helpful.
>
> We'll run this for a touch over two weeks, ending the WGLC on December 10,
> 2017. We look forward to your comments :)
>
> -Patrick
>
>

---

From: Eric Rescorla <[email-masked]>
Date: Mon, 12 Feb 2018 16:40:58 -0800

On Mon, Feb 12, 2018 at 4:24 PM, Jeffrey Yasskin <[email-masked]>
wrote:

> I apologize for sending this so long after the WGLC deadline, but I
> noticed that draft-ietf-httpbis-replay-02, "Using Early Data in HTTP",
> doesn't mention the risks of sending non-PFS early data.
>
> requests with an "omit" credentials mode: https://fetch.spec.whatwg.org/
> #concept-request-credentials-mode.) Should private-browsing modes avoid
> early-data entirely? Should all browsing modes restrict it to cases where
> they have evidence that the request data isn't private?
>

The FS properties of TLS 1.3 Early Data are basically the same as those of
TLS 1.2 resumption, and to the best of my knowledge, no client avoids
sending credentials when in resumption mode, so I don't think that this is
an appropriate way to handle it.

-Ekr

>> We'll run this for a touch over two weeks, ending the WGLC on December
>> 10, 2017. We look forward to your comments :)
>>
>> -Patrick
>>
>>

---

From: Jeffrey Yasskin <[email-masked]>
Date: Tue, 13 Feb 2018 01:01:50 +0000

> an appropriate way to handle it.

The comparison to TLS 1.2 resumption makes sense. Thanks.

Jeffrey