Subject: [TLS] Text for draft-ietf-tls-rfc4366-bis

From: "Joseph Salowey (jsalowey)" <[email-masked]>
Date: Wed, 19 May 2010 22:15:06 -0700

Below is some proposed text for inclusion in section 3 of
draft-ietf-tls-rfc4366-bis. The text now clarifies that the server name
can be used by the server in looking up the cached session.   Please
respond to the list with any issues or improvements to the text.  

Thanks,

Joe

New text in section 3 to replace "When the server resumes a session, the
server_name extension is ignored.":

"When the server resumes a session, the contents of server_name
extension may be used in the lookup of the session in the session cache.
The client SHOULD include the same server_name extension during session
resumption as it did in the full handshake that established the session.
The client MAY omit the extension, in which case, if the server chooses
to resume the session it must use the server name cached from the
original full handshake.  The client MUST NOT include a different server
name than what is included in the original full handshake.  If the
server_name extension contains a different name the server MUST NOT
allow the session to be resumed.  Instead, it proceeds with a full
handshake to establish a new session. When resuming a session, the
server MUST NOT include a server_name extension in the server hello."

In addition the end of section 1.1 needs some modification to the last
paragraph and bullet points: 

"Note also that all the extensions defined in this document are
 relevant only when a session is initiated.  When a client includes
 one or more of the defined extension types in an extended client
 hello while requesting session resumption:

      -  If the resumption request is denied, the use of the extensions
         is negotiated as normal.

	-  The server name indication extension MAY be used during the 
         lookup of a cached session as described in section 3. 

      -  If, on the other hand, the older session is resumed, then the
         server MUST ignore the extensions and send a server hello
         containing none of the extension types.  In this case, the
         functionality of these extensions negotiated during the
         original session initiation is applied to the resumed session."

Cheers,

Joe

---

From: "t.petch" <[email-masked]>
Date: Thu, 20 May 2010 12:03:44 +0200

Joe

I think that it still avoids the point that has been raised.

Setting aside my dislike of using 'session resumption':-), I think that
the new text should split out the decision as to whether or not to
accept such a request from the subsequent mechanics ie the first
sentence must be along the lines of

"When the server is deciding whether or not to accept a request to resume a
session, the contents of a server_name extension may be used in the lookup of
the session in the session cache."
followed by such as
"The client SHOULD include the same server_name extension during session
resumption request as it did in the full handshake that established the session.
If the server_name extension contains a different name, the server MUST NOT
accept the request to resume the session. Instead, it proceeds with a full
handshake to establish a new session

" The client MAY omit the extension, in which case, if the server chooses
to resume the session, it must use the server name cached from the
original full handshake.

"When resuming a session, the server MUST NOT include a server_name extension in
the server hello."
etc

Tom Petch

----- Original Message -----
From: "Joseph Salowey (jsalowey)" <[email-masked]>
To: <[email-masked]>
Sent: Thursday, May 20, 2010 7:15 AM
Subject: [TLS] Text for draft-ietf-tls-rfc4366-bis

> _______________________________________________
> TLS mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/tls

---

From: "Joseph Salowey (jsalowey)" <[email-masked]>
Date: Thu, 20 May 2010 08:29:21 -0700

Good suggestion, thanks for the text, here is the text reworked:

"When the server is deciding whether or not to accept a request to
resume
 a session, the contents of a server_name extension may be used in 
 the lookup of the session in the session cache.  The client SHOULD 
 include the same server_name extension in session resumption 
 request as it did in the full handshake that established the
 session.  If the server_name extension contains a different name, 
 the server MUST NOT accept the request to resume the session. 
 Instead, it proceeds with a full handshake to establish a new 
 Session.  The client MAY omit the extension, in which case, if 
 the server chooses to resume the session, it must use the server 
 name cached from the original full handshake. When resuming a 
 session, the server MUST NOT include a server_name extension in
 the server hello."

Changes to section 1.1

	-  The server name indication extension MAY be used by the 
         server when deciding whether or not to resume a session 
         as described in section 3.

> -----Original Message-----
> From: t.petch [mailto:[email-masked]]
> Sent: Thursday, May 20, 2010 3:04 AM
> To: Joseph Salowey (jsalowey); [email-masked]
> Subject: Re: [TLS] Text for draft-ietf-tls-rfc4366-bis
> 
> Joe
> 
> "When the server is deciding whether or not to accept a request to
resume
> a
> session, the contents of a server_name extension may be used in the
lookup
> of
> resumption request as it did in the full handshake that established
the
> session.
> If the server_name extension contains a different name, the server
MUST
> NOT

---

From: Michael D'Errico <[email-masked]>
Date: Thu, 20 May 2010 08:36:24 -0700

Joe - the new text looks good to me.

Mike

---

From: "t.petch" <[email-masked]>
Date: Thu, 20 May 2010 18:28:17 +0200

yes, works for me.
Tom Petch

----- Original Message ----- 
From: "Joseph Salowey (jsalowey)" <[email-masked]>
To: "t.petch" <[email-masked]>; <[email-masked]>
Sent: Thursday, May 20, 2010 5:29 PM
Subject: RE: [TLS] Text for draft-ietf-tls-rfc4366-bis

Changes to section 1.1

resume
lookup
the
MUST

---

From: Martin Rex <[email-masked]>
Date: Thu, 20 May 2010 20:10:58 +0200 (MEST)

Joseph Salowey wrote:
>  resume a session, the contents of a server_name extension may be used
>  in the lookup of the session in the session cache.  The client SHOULD 

The requirements appear somewhat imbalanced to me.
In order to conform to the requirement

   If the server_name extension contains a different name,
   the server MUST NOT accept the request to resume the session.

every server must (a) implement server_name extension and (b)
memorize the content from the initial handshake in the TLS session
cache.  At that point the "may be used in the lookup of the session"
effectively becomes a MUST be used in the lookup of the session,
because the contents will always have to be verified before agreeing
a session resumption, even if the server_name contents isn't
technically used as a "lookup key" into the cache.

This MUST NOT would need to be scoped to the implementors of the
"MAY be used in the lookup of the session", and the MAY in the
first sentence probably be uppercased.

>From the architecture point of view, I see the following issues
to consider about interaction of ClientHello parameters and
session resumption:

 -  ClientHello parameters from the session resumption request
    MUST NOT affect the session within the session cache at all
    (except possibly deleting the session on a failed resumption)

 -  ClientHello parameters from the session resumption request
    MUST affect connection parameters only in documented fashion
    (derivation of keying material e.g. through additional PRF input,
     renegotiation_info extension)

 -  ClientHello parameters MUST be checked for compatibility with
    the characteristics of the cached session before resumption,
    but this check is limited to those parameters that the server
    actually implements/supports.

 -  In addition, a server may decide that ClientHello parameters
    provides characteristics that the server would prefer over the
    characteristics of the cached session and go for a full handshake

-Martin

---

From: "Joseph Salowey (jsalowey)" <[email-masked]>
Date: Thu, 20 May 2010 14:22:01 -0700

Hi Martin,

Thanks, I think I captured your suggestion below.  

"When the server is deciding whether or not to accept a request to
resume a session, the contents of a server_name extension MAY be used in
the lookup of the session in the session cache.  The client SHOULD
include the same server_name extension in session resumption request as
it did in the full handshake that established the session.  A server
that implements this extension MUST NOT accept the request to resume the
session if the server_name extension contains a different name.
Instead, it proceeds with a full handshake to establish a new session.
The client MAY omit the extension, in which case, if  the server chooses
to resume the session, it must use the server name cached from the
original full handshake. When resuming a  session, the server MUST NOT
include a server_name extension in  the server hello."

> From: Martin Rex [mailto:[email-masked]]
> Sent: Thursday, May 20, 2010 11:11 AM
> To: Joseph Salowey (jsalowey)
> Cc: [email-masked]; [email-masked]

---

From: "Joseph Salowey (jsalowey)" <[email-masked]>
Date: Fri, 21 May 2010 15:00:51 -0700

After an offline discussion with Martin I think we really should remove
the sentence " The client MAY omit the extension..." Omitting the
extension seems like a really bad idea, because if the session is not
resumed the client may establish a session with different
characteristics than what was intended. So now we have:

"When the server is deciding whether or not to accept a request to
resume a session, the contents of a server_name extension MAY be used in
the lookup of the session in the session cache.  The client SHOULD
include the same server_name extension in session resumption request as
it did in the full handshake that established the session.  A server
that implements this extension MUST NOT accept the request to resume the
session if the server_name extension contains a different name. Instead,
it proceeds with a full handshake to establish a new session. When
resuming a session, the server MUST NOT include a server_name extension
in  the server hello." 

I think it is also worthwhile to include the guidance from section
7.4.1.4 in RFC 5246 in the paragraph at the end of section 1.1.:

"Note also that all the extensions defined in this document are
relevant only when a session is initiated.  A client that requests
session resumption does not in general know whether the server will
accept this request, and therefore it SHOULD send the same extensions as
it would send if it were not attempting resumption. When a client
includes  one or more of the defined extension types in an extended
client  hello while requesting session resumption:

Joe

> From: [email-masked] [mailto:[email-masked]] On Behalf Of
> Joseph Salowey (jsalowey)
> Sent: Thursday, May 20, 2010 2:22 PM
> To: [email-masked]
> Cc: [email-masked]

---

From: Martin Rex <[email-masked]>
Date: Thu, 27 May 2010 20:13:10 +0200 (MEST)

> characteristics than what was intended. So now we have:

Thank you for you efforts.

I'm fine with this clarification.

-Martin

PS: maybe some others (in particular who discussed this particular
    topic) could provide their feedback so that Joe gets somewhat more
    than deafening silence to determine whether there is consensus.  ;-)

---

From: Michael D'Errico <[email-masked]>
Date: Thu, 27 May 2010 13:45:24 -0700

I advocated this from the beginning, but others thought that it
wouldn't be backward-compatible.  I was willing to accept the
"MAY omit" as a compromise, but if we want to do it right, the
client really does need to send the same SNI when attempting to
resume a previous session.

I think we should still keep the text that explains what a server
should do IF the client omits the SNI when trying to resume a past
session (use the same name that was sent in the original handshake).

Mike

---

From: Donald Eastlake <[email-masked]>
Date: Sat, 29 May 2010 15:54:52 -0400

Since we seem to have reached stable text, I have updated the draft
and will post a new version.

Thanks,
Donald
=============================
 Donald E. Eastlake 3rd   +1-508-333-2270 (cell)
 155 Beaver Street   +1-508-634-2066 (home)
 Milford, MA 01757 USA
 [email-masked]