Subject: [Unbearable] Can we change what happens when the client gets TB header but not EMS?

From: Bill Cox <[email-masked]>
Date: Fri, 4 Sep 2015 11:50:29 -0700

The spec says the client must abort the handshake it receives a Token
Binding extension from the server, but not the Extended Master Secret
extension.  Could we change this to say that the client must ignore the
Token Binding extension rather than abort?

This slightly simplifies implementation.  Since the client may receive the
Token Binding extension before the Extended Master Secret extension, it
can't abort right there, and instead has to set some state and wait for the
extensions to be fully parsed and then abort.  I am using the Custom
Extension API in OpenSSL, and any decision to abort has to be made when
parsing the extension.

This extension really is a good candidate for the Custom Extension API.
This is the only remaining part of the Token Binding spec I am not 100%
able to follow using this API.

Thanks,
Bill

---

From: Andrei Popov <[email-masked]>
Date: Fri, 4 Sep 2015 19:29:27 +0000

There must be a point where you can enumerate the negotiated extensions and abort the connection if TB is there, but EMS isn’t. This doesn’t have to be at the time you process the ClientHello. You could even disconnect after the handshake is done.

Cheers,

Andrei

From: Unbearable [mailto:[email-masked]] On Behalf Of Bill Cox
Sent: Friday, September 4, 2015 11:50 AM
To: [email-masked]; Nick Harper <[email-masked]>
Subject: [Unbearable] Can we change what happens when the client gets TB header but not EMS?

The spec says the client must abort the handshake it receives a Token Binding extension from the server, but not the Extended Master Secret extension.  Could we change this to say that the client must ignore the Token Binding extension rather than abort?

This slightly simplifies implementation.  Since the client may receive the Token Binding extension before the Extended Master Secret extension, it can't abort right there, and instead has to set some state and wait for the extensions to be fully parsed and then abort.  I am using the Custom Extension API in OpenSSL, and any decision to abort has to be made when parsing the extension.

This extension really is a good candidate for the Custom Extension API.  This is the only remaining part of the Token Binding spec I am not 100% able to follow using this API.

Thanks,
Bill

---

From: Bill Cox <[email-masked]>
Date: Fri, 4 Sep 2015 13:22:08 -0700

On Fri, Sep 4, 2015 at 12:29 PM, Andrei Popov <[email-masked]>
wrote:

> There must be a point where you can enumerate the negotiated extensions
> and abort the connection if TB is there, but EMS isn’t. This doesn’t have
> to be at the time you process the ClientHello. You could even disconnect
> after the handshake is done.
>
>
>
> Cheers,
>
>
>
> Andrei
>
>
> Can I push dropping the connection into the application stack?  For
example, before adding the HTTP Token Binding header, check there and
disconnect if EMS is not enabled?

Thanks,
Bill

---

From: Andrei Popov <[email-masked]>
Date: Fri, 4 Sep 2015 21:11:37 +0000

I think this is fine. There are multiple other applications that require EMS for security, e.g. EAP. Typically, they query for EMS after the handshake.

From: Bill Cox [mailto:[email-masked]]
Sent: Friday, September 4, 2015 1:22 PM
To: Andrei Popov <[email-masked]>
Cc: [email-masked]; Nick Harper <[email-masked]>
Subject: Re: [Unbearable] Can we change what happens when the client gets TB header but not EMS?

On Fri, Sep 4, 2015 at 12:29 PM, Andrei Popov <[email-masked]<mailto:[email-masked]>> wrote:
There must be a point where you can enumerate the negotiated extensions and abort the connection if TB is there, but EMS isn’t. This doesn’t have to be at the time you process the ClientHello. You could even disconnect after the handshake is done.

Cheers,

Andrei

Can I push dropping the connection into the application stack?  For example, before adding the HTTP Token Binding header, check there and disconnect if EMS is not enabled?

Thanks,
Bill

---

From: Bill Cox <[email-masked]>
Date: Fri, 4 Sep 2015 16:59:36 -0700

Thanks.  I'll do it that way.

On Fri, Sep 4, 2015 at 2:11 PM, Andrei Popov <[email-masked]>
wrote:

> I think this is fine. There are multiple other applications that require
> EMS for security, e.g. EAP. Typically, they query for EMS after the
> handshake.
>
>
>
> *From:* Bill Cox [mailto:[email-masked]]
> *Sent:* Friday, September 4, 2015 1:22 PM
> *To:* Andrei Popov <[email-masked]>
> *Cc:* [email-masked]; Nick Harper <[email-masked]>
> *Subject:* Re: [Unbearable] Can we change what happens when the client
> gets TB header but not EMS?
>
>
>

---

From: Ted Lemon <[email-masked]>
Date: Fri, 4 Sep 2015 21:20:43 -0400

> There must be a point where you can enumerate the negotiated extensions and abort the connection if TB is there, but EMS isn’t. This doesn’t have to be at the time you process the ClientHello. You…

It would of course ultimately be really bad (error-prone) if this were left to the caller and not done automatically by the library.   I realize that we’re really talking about a prototype here, but existing practice has a way of ossifying.