Subject: HTTPBis Call For Adoption: Using Early Data in HTTP [aka Replay]

From: Patrick McManus <[email-masked]>
Date: Wed, 09 Aug 2017 15:25:00 +0000 (UTC)

https://www.ietf.org/internet-drafts/draft-thomson-http-replay-01.txt

We've been discussing the risks of algorithms around early data both on the
list and face to face recently in Prague. This draft from Martin, Wily, and
Mark has obviously been the nexus of that conversation and the group
informally signaled support for adding it as a working group item during
the recent meeting.

Please state whether you support adoption, and ideally why. Expressions of
interest in implementation would also be very helpful.

We'll wait at least a week to make a decision, but hopefully we can move
quickly here.

-Patrick

---

From: Benjamin Kaduk <[email-masked]>
Date: Wed, 9 Aug 2017 16:05:29 -0500

On 08/09/2017 10:25 AM, Patrick McManus wrote:
> <https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_internet-2Ddrafts_draft-2Dthomson-2Dhttp-2Dreplay-2D01.txt&d=DwMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=sssDLkeEEBWNIXmTsdpw8TZ3tAJx-Job4p1unc7rOhM&m=uPvTnvjSvjqcivpFpYiq9O7yv6M0XprTPGi_Jy-dAuQ&s=sAf9tHbal7GzGYC9N-JmdYTxwOcn951kZeNsIpzPEYo&e=>
>
> We've been discussing the risks of algorithms around early data both
> on the list and face to face recently in Prague. This draft from
> Martin, Wily, and Mark has obviously been the nexus of that
> conversation and the group informally signaled support for adding it
> as a working group item during the recent meeting.
>
> Please state whether you support adoption, and ideally why.
> Expressions of interest in implementation would also be very helpful.

I support adopting this document -- HTTP is perhaps the biggest
potential use case for TLS 1.3 early-data, and it would be good to have
an application profile ready for implementors along with the final TLS
1.3 specification.  This document has had a lot of analysis go into it
already, and
seems to reflect the necessary properties and implementation behavior
(or nearly so) as far as we can tell so far.

-Ben

---

From: Alessandro Ghedini <[email-masked]>
Date: Sat, 12 Aug 2017 11:54:15 +0100

> We'll wait at least a week to make a decision, but hopefully we can move

I support adoption and intend to implement this. Due to, uhm, architectural
difficulties, implementing the delay of early HTTP requests until handshake
completion has been more annoying than originally thought, and the new 4nn
status code provides a much simpler alternative. I also welcome standardisation
in the way intermediaries signal early data requests to origins.

Cheers

---

From: Victor Vasiliev <[email-masked]>
Date: Sat, 12 Aug 2017 12:46:07 -0400

I have reviewed the -01 version of the draft and I support its adoption.  I
am looking forward to implementing this as soon as the error code number is
stable.

Incidentally, the draft should specify what client should do if it receives
a 4NN for a non-early request.

  -- Victor.

On Wed, Aug 9, 2017 at 11:25 AM, Patrick McManus <[email-masked]>
wrote:

> We've been discussing the risks of algorithms around early data both on
> the list and face to face recently in Prague. This draft from Martin, Wily,
> and Mark has obviously been the nexus of that conversation and the group

---

From: Patrick McManus <[email-masked]>
Date: Thu, 17 Aug 2017 12:21:24 +0000 (UTC)

Reupping this thread as it has been a week. Not too late to make a
contribution to it.

---

From: Kazuho Oku <[email-masked]>
Date: Thu, 17 Aug 2017 22:44:02 +0900

2017-08-10 0:25 GMT+09:00 Patrick McManus <[email-masked]>:
> informally signaled support for adding it as a working group item during the
> recent meeting.
>

I strongly support adoption.

We need to standardize this draft to use Early Data in HTTP.

Early Data has been an attractive feature for many of us. In fact, it
is so attractive that some of us have already started deploying it on
the Web. The methods defined in the draft are mandatory for us to
support Early Data in a truly effective and secure manner.

H2O will implement the draft as soon as the 4NN status code is registered.

-- 
Kazuho Oku

---

From: Erik Nygren <[email-masked]>
Date: Thu, 17 Aug 2017 10:37:02 -0400

+1

I also strongly support adoption. Agreeing on and specifying how early data
works as-safely-as-possible between TLS 1.3 and HTTP will be critical
before we end up with non-interoperable or vulnerable-when-interoperating
implementations.  It is attractive enough that it seems likely partial
implementations will show up in production before we standardize,
especially if there is too much of a time gap between this and TLS 1.3
completing.

- Erik

On Aug 17, 2017 9:49 AM, "Kazuho Oku" <[email-masked]> wrote:

> We've been discussing the risks of algorithms around early data both on
the
> informally signaled support for adding it as a working group item during
the

---

From: Leif Hedstrom <[email-masked]>
Date: Thu, 17 Aug 2017 10:38:34 -0600

> On Aug 9, 2017, at 9:25 AM, Patrick McManus <[email-masked]> wrote:
> 
> 
> https://www.ietf.org/internet-drafts/draft-thomson-http-replay-01.txt <https://www.ietf.org/internet-drafts/draft-thomson-http-replay-01.txt>
> 
> We've been discussing the risks of algorithms around early data both on the list and face to face recently in Prague. This draft from Martin, Wily, and Mark has obviously been the nexus of that conversation and the group informally signaled support for adding it as a working group item during the recent meeting.
> 
> Please state whether you support adoption, and ideally why. Expressions of interest in implementation would also be very helpful.
> 
> We'll wait at least a week to make a decision, but hopefully we can move quickly here.

Yes, I support adoption. We would implement this in Apache Traffic Server (reverse, forward and transparent proxy server).

Cheers,

— leif

---

From: Mike Bishop <[email-masked]>
Date: Thu, 17 Aug 2017 17:02:02 +0000

I support adoption of this draft.  It will likely be supported in Windows by client and server roles once we ship 0-RTT TLS 1.3 support.

From: Patrick McManus [mailto:[email-masked]]
Sent: Thursday, August 17, 2017 5:21 AM
To: Patrick McManus <[email-masked]>
Cc: HTTP Working Group <[email-masked]>
Subject: Re: HTTPBis Call For Adoption: Using Early Data in HTTP [aka Replay]

Reupping this thread as it has been a week. Not too late to make a contribution to it.

On Wed, Aug 9, 2017 at 11:24 AM, Patrick McManus <[email-masked]<mailto:[email-masked]>> wrote:

https://www.ietf.org/internet-drafts/draft-thomson-http-replay-01.txt<https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%2Finternet-drafts%2Fdraft-thomson-http-replay-01.txt&data=02%7C01%7CMichael.Bishop%40microsoft.com%7C486336f088b24445956708d4e56b3531%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636385695993140650&sdata=Qpv%2Fbru3HeeaXzKXwrWh6AoUv5Hs7TV3xyVfZPBk5nA%3D&reserved=0>

-Patrick

---

From: Amos Jeffries <[email-masked]>
Date: Sat, 19 Aug 2017 01:46:15 +1200

On 10/08/17 03:25, Patrick McManus wrote:
> the list and face to face recently in Prague. This draft from Martin, 
> Wily, and Mark has obviously been the nexus of that conversation and the 
> group informally signaled support for adding it as a working group item 
> during the recent meeting.
> 
> Please state whether you support adoption, and ideally why. Expressions 
> of interest in implementation would also be very helpful.
> 

 From Squid. Tentative support for adoption.

I have not heard explicitly from the guys working on TLS/SSL, so cannot 
speak as to implementation. However that goes it will be good to have 
something documented about the issues in this space.

Amos

---

From: Patrick McManus <[email-masked]>
Date: Fri, 18 Aug 2017 13:34:51 -0400

Thank you all for the input.

This is Adopted.

Author(s), please get it into the repo and submit as
draft-ietf-httpbis-http-replay-00. Thanks!

(Wily, Authors of current drafts are normally members of the github repo so
you can work there. if you send me your github ID I'll add you as member -
or you can rely on your co-authors for that.)

---

From: Martin Thomson <[email-masked]>
Date: Sat, 19 Aug 2017 19:02:33 +1000

If you don't mind, I'd prefer to just move the repo and have it
separate from the whole mess of other drafts.

---

From: Patrick McManus <[email-masked]>
Date: Sun, 20 Aug 2017 07:20:39 -0400

interesting, I've come full circle on this question and am content having
one place to look for all of these smaller projects (tho as I say - full
circle.). Basically if the email notifications had the file name in the
subject line I would be 100% happy. Mark - where do you stand now?

On Sat, Aug 19, 2017 at 5:02 AM, Martin Thomson <[email-masked]>
wrote:

> Wily,

---

From: Martin Thomson <[email-masked]>
Date: Mon, 21 Aug 2017 17:41:41 +1000

I don't see listing and discovery as a problem.  We can (and should)
modify the various directories so that the new thing can be found, but
I find that https://github.com/httpwg/ is pretty good already.  I can
generate a PR on the extensions repo (and maybe the homepage, though I
agree that's harder to do given its current structure) so that it is
listed correctly.

On 20 August 2017 at 21:20, Patrick McManus <[email-masked]> wrote:
>> >>> on
>> >>> Expressions

---

From: Mark Nottingham <[email-masked]>
Date: Mon, 21 Aug 2017 09:15:02 -0700

Well, it's obviously a bike shed, although perhaps we're arguing over the number of doors it needs.

Having one-thing-not-like-the-others isn't optimal, so if we change this it should be how we work going forward. My understanding was that we had decided to stick to the current model, at least for "small" efforts (like this), because both the administrative overhead and the likelihood of errors were significantly higher.

If we start HTTPtre / bisbis / prime / whatever, I can't see that in the "extensions" repo (and not just because it's not an extension). Arguably, Cookiebis should have been separate too, but c'est la vie. I wouldn't reject a suggestion to split it off into a separate repo now, if Mike was interested.

I suspect that Martin has been planning this for some time, and so rarely like to disappoint him, but this may be one of those occurrences. 

Cheers,

> On 20 Aug 2017, at 4:20 am, Patrick McManus <[email-masked]> wrote:
> 
> interesting, I've come full circle on this question and am content having one place to look for all of these smaller projects (tho as I say - full circle.). Basically if the email notifications had the file name in the subject line I would be 100% happy. Mark - where do you stand now?
> 
> On Sat, Aug 19, 2017 at 5:02 AM, Martin Thomson <[email-masked]> wrote:

--
Mark Nottingham   https://www.mnot.net/