Subject: Re: [TLS] Interest in taking draft-seggelmann-tls-dtls-heartbeat-01 as a working group item

From: Gerhard Muenz <[email-masked]>
Date: Tue, 02 Mar 2010 09:30:14 +0100

Dear all,

I would appreciate a lot if the TLS WG adopted this document. This 
extension is essential for using DTLS/UDP with push protocols, such as 
IPFIX.

We will post an update of draft-mentz-ipfix-dtls-recommendations-00 to 
explain the dead-peer detection issue and the need for reliable PMTU 
discovery.

Unfortunately, I do not have enough (D)TLS expertise to provide a 
competent review.

Thanks,
Gerhard

> Since the last call for interest ran up against the re-negotiation issue
> I would like to check again to see if there is interest in taking this
> up as a TLS working group item.  Please respond if you approve or
> disapprove taking this on as a working group item.  If you approve
> please indicate if you are willing to contribute text or review.  Please
> respond by March 12, 2010. 
> 
> 
> Thanks,
> 
> Joe

---

From: Michael Tüxen <[email-masked]>
Date: Tue, 2 Mar 2010 10:28:08 +0100

Dear all,

the authors of the ID would appreciate if the document gets
adopted as a WG item.

Best regards
Michael
> 
> 
> Thanks,
> 
> Joe
> _______________________________________________
> TLS mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/tls
>

---

From: Daniel Mentz <[email-masked]>
Date: Wed, 10 Mar 2010 14:08:24 +0100

I endorse this document and suggest to take it up as a TLS working group 
item.

Without the DTLS heartbeat extension, an endpoint is unable to find out 
whether its peer is still alive and whether it still has the DTLS 
connection state. This state is necessary to decrypt and verify DTLS 
records.

An application that is based on the request/response paradigm might 
detect this situation if the peer fails to respond. However, 
unidirectional applications like IPFIX never send any kind of response. 
draft-mentz-ipfix-dtls-recommendations-01 elaborates on this issue.

The heartbeat extension can also be used to perform PMTU discovery in an 
elegant way.

Speaking about the PMTU: I suggest that DTLS implementations provide 
upper layers with the maximum size of user messages. Even if the PMTU is 
known to the application, it is unable to determine the maximum size of 
user messages because the overhead incurred by the DTLS record layer 
depends on the negotiated cipher suite. If the DTLS layer does not 
provide the maximum message size, it should at least provide the amount 
of overhead incurred by DTLS.

-Daniel Mentz