Subject: Re: [TLS] Resumption and Forward Secrecy, 0-RTT and Safety

From: Ryan Hamilton <[email-masked]>
Date: Wed, 13 Apr 2016 15:57:50 -0700

On Tue, Mar 29, 2016 at 10:18 PM, Tony Arcieri <[email-masked]> wrote:

> On Mon, Mar 28, 2016 at 3:49 PM, Ryan Hamilton <[email-masked]> wrote:
>
>> ​We (Chrome) definitely want this (sending cookies in 0-RTT requests),
>> and are doing this today with QUIC (which we can't wait to TLS 1.3-ify). ​
>>
>
> I went to RealWorldCrypto 2016 and saw the TLS track and all of the
> analysis TLS 1.3 has received, and while it wasn't TRON, I can sympathize
> with why you might want TLS 1.3, namely the extensive analysis it is
> receiving as an up and coming cryptographic standard which is a clear
> choice for academic researchers to focus on.
>
> That said, I really don't understand Google's excitement to switch from
> QUIC's crypto to TLS 1.3. QUIC crypto seems like a much simpler and cleaner
> protocol which fulfills many of the same goals as TLS, and while it hasn't
> received as much scrutiny as TLS 1.3, it seems like it doesn't need as much
> by design due to its relative simplicity.
>
> I also understand Facebook is adding QUIC-crypto-over-TCP support to
> proxygen (there was also a talk at RWC2016) for use in their mobile apps as
> a stopgap for doing 0-RTT until such a time as 0-RTT ships in TLS 1.3.
>
> Can you speak to specific reasons why the Chrome team "can't wait to TLS
> 1.3-ify" over QUIC, specifically reasons different from the ones I have
> already highlighted above?
>

​QUIC Crypto was created by Adam Langley at the start of the project. I
believe he has said that if TLS could have provided the functionality we
needed (wanted) at the time, he would have used it. Maintaining two
different crypto handshake paths is undesirable. There are a number of
features in TLS that we don't have in QUIC crypto (client certificates, for
example). We don't need them for the experiments/deployments we've run so
far, but we'll need them if we want QUIC to ubiquitous. If we can get all
of this "for free" from TLS, that sounds awesome.​ There is no way Chrome
is ever going to ship without TLS, so the choice we have is between TLS +
QUIC Crypto, or just TLS. Just TLS sounds pretty good to me.

I hope that helps.