Subject: Re: [TLS] TLS Cached Information Extension - version 11

From: Sean Turner <[email-masked]>
Date: Mon, 28 May 2012 15:49:40 -0400

On 12/26/11 4:46 AM, Hannes Tschofenig wrote:
> Hi all,
>
> Nikos provided review comments (see
> http://www.ietf.org/mail-archive/web/tls/current/msg08338.html) and I
> have incorporated them in version 11 of the draft:
> http://www.ietf.org/internet-drafts/draft-ietf-tls-cached-info-11.txt
>
> As you can see, there are a number of smaller changes here and there. I
> hope that readability has improved.
>
> There is an open issue: algorithm negotiation
>
> Currently, the draft defines a registry for hash algorithms that are
> used to produce the hashes of cached information. The client can tell
> the server that it has already cached, for example, the certificate
> chain. The server then has to only send the fingerprint of it (rather
> than the complete certificate chain). The other information (besides
> certificate chains) that can be "fingerprinted" is the list of trusted
> CAs. Does this cover all use cases?
>
> A few algorithms are defined, namely SHA-1, SHA-224, SHA-256, SHA-384,
> SHA-512. Is this a good list to start with?

Yes this looks like a good list.

Nit: might change the reference from SHA to SHS.  Also, to avoid the 
downref can we just use SHS for the SHA-224 reference?

On the hash alg registry, why aren't we reusing the TLS HashAlgorithm 
Registry?  If you're worried folks will be confused about if they can 
use it with SignatureAlgorithms can't we just add another column in the 
registry and indicate whether it's okay to use it for cached 
info/signaturealgorithms?

> The draft does not define a way for the client to tell the server that
> it only supports a certain hash algorithm. Should we allow the client to
> indicate what algorithm it supports?

And some more nits:

s1: r/Transport Layer Security (TLS)/Transport Layer Security (TLS) 
[RFC5246]

r/I-D.ietf-tls-rfc4366-bis/RFC6066

r/draft-ietf-tls-rfc4366-bis-12 (work in progress), September 2010/RFC 
6066, January 2011

r/I-D.iab-smart-object-workshop/RFC 6574

r/draft-iab-smart-object-workshop-06 (work in progress), October 
2011/RFC 6574, April 2012

r/wouters-tls-oob-pubkey/tls-oob-pubkey-03

r/draft-wouters-tls-oob-pubkey-02 (work in progress), November 
2011/draft-ietf-tls-oob-pubkey-03 (work in progress), April 2012

spt