Subject: Re: [TLS] CCS and key reset and renegotiation

From: Peter Gutmann <[email-masked]>
Date: Fri, 6 Jun 2014 08:00:42 +0000

Watson Ladd <[email-masked]> writes:

>Because the Certificate, Certificate Request, ServerKeyExchange, and some
>other messages in the handshake are optional, I don't see how a ladder
>diagram can encapsulate the protocol. 

... and yet somehow everyone who's ever tried to document it this way has
succeeded.

(Well, OK, that's a bit absolute, there may be thousands of people out there
who've tried to do this and given up that we don't know about, but somehow I
doubt it.  When I did SSL it was so obviously a ladder diagram that I just
ignored all the state-machine stuff in the spec and implemented the protocol
as such.  My implementation couldn't be made vulnerable to the recent OpenSSL
issue without rewriting half the code).

Peter.

---

From: "Salz, Rich" <[email-masked]>
Date: Fri, 6 Jun 2014 10:46:55 -0400

So, of course, a ladder is a state machine where there's no going backward or loops.  That means that it's simpler, right?

Perhaps someone can go to https://www.websequencediagrams.com and sketch it out?

	/r$

--  
Principal Security Engineer
Akamai Technologies, Cambridge, MA
IM: [email-masked]; Twitter: RichSalz

---

From: Watson Ladd <[email-masked]>
Date: Fri, 6 Jun 2014 08:26:17 -0700

There is a loop! When receiving application data the state doesn't advance.

Also renegotiation loops, as does resumption.

As for the ladder diagram, early in the RFC there is one.

On Fri, Jun 6, 2014 at 7:46 AM, Salz, Rich <[email-masked]> wrote:
> So, of course, a ladder is a state machine where there's no going
backward or loops. That means that it's simpler, right?
> _______________________________________________
> TLS mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/tls

-- 
"Those who would give up Essential Liberty to purchase a little Temporary
Safety deserve neither Liberty nor Safety."
-- Benjamin Franklin

---

From: "Salz, Rich" <[email-masked]>
Date: Fri, 6 Jun 2014 11:29:01 -0400

I guess, pedantically, the appdata is a loop.  But renegotiation is going away, and I need to think about resumption a bit.

Perhaps Peter, when he sees these notes in his timezone, can comment.

                /r$

--
Principal Security Engineer
Akamai Technologies, Cambridge, MA
IM: [email-masked]<mailto:[email-masked]>; Twitter: RichSalz

From: Watson Ladd [mailto:[email-masked]]
Sent: Friday, June 06, 2014 11:26 AM
To: Salz, Rich
Cc: Peter Gutmann; [email-masked]
Subject: Re: [TLS] CCS and key reset and renegotiation

On Fri, Jun 6, 2014 at 7:46 AM, Salz, Rich <[email-masked]<mailto:[email-masked]>> wrote:
> IM: [email-masked]<mailto:[email-masked]>; Twitter: RichSalz
>
> [email-masked]<mailto:[email-masked]>

--
"Those who would give up Essential Liberty to purchase a little Temporary Safety deserve neither Liberty nor Safety."
-- Benjamin Franklin

---

From: Paul Lambert <[email-masked]>
Date: Fri, 6 Jun 2014 08:47:53 -0700

>backward or loops.  That means that it's simpler, right?

Š and incomplete.  The ladder diagram or sequence diagram represents one
possible path through the state transitions.  With enough ladder diagrams
you might cover all the behavior, but this is rarely done.  Often a few
diagrams cover all the interesting Œnormal¹ behavior, but of course the
many error condition behaviors are ignored.

On the down side, state machines are hard to draw in ASCII text in an RFC.

Paul

---

From: "Salz, Rich" <[email-masked]>
Date: Fri, 6 Jun 2014 11:49:24 -0400

I wasn't suggesting a set of ladders to replace a state machine.  Peter said it's not really a state machine but rather a ladder. I was emphasizing that, *if this is true*, then a ladder approach is way much better.

	/r$