Subject: Re: [TLS] Fwd: I-D Action:draft-bmoeller-tls-falsestart-00.txt

From: Nicolas Williams <[email-masked]>
Date: Wed, 14 Jul 2010 18:11:05 -0500

Huh, I independently proposed a something similar, though I call it
early_start, in April 2009, in draft-williams-tls-app-sasl-opt-03.

draft-williams-tls-app-sasl-opt-03 was a bit confused because I hadn't
removed all references to a handshake message I had proposed in earlier
versions of the same I-D.  I've -04 ready to go, but since I've missed
the cut-off for the upcoming IETF meeting, I can't submit it at this
time.  I've posted the -04 to the KITTEN WG list:

http://www.ietf.org/mail-archive/web/kitten/current/msg01877.html

I believe that this "false start" or "early start" approach, with
SASL/GSS-API and channel binding, is ideal for optimizing the number of
round-trips needed by applications to do authentication above TLS.

In my proposal a Hello extension is used for SASL/GS2 mechanism
negotiation, and another Hello extension is used to negotiate "early
start" of the selected SASL/GSS-API mechanism.

Mechanisms that would be immediately available for use in this way
include:

 - SCRAM [RFC5802] (DIGEST-MD5's successor)
 - Kerberos V5 [RFC4120] via RFCs 5801, 4121 and 1964.

and soon enough probably also IAKERB (Kerberos but with KDC
communications proxied by the acceptor) and Kerberos user-to-user
authentication.

For background: "GS2" [RFC5801] is a very simple bridge that allows
GSS-API [RFC2743] mechanisms to be used as SASL [RFC4422] mechanisms.

Nico
--

---

From: Nicolas Williams <[email-masked]>
Date: Fri, 16 Jul 2010 13:18:05 -0500

> early_start, in April 2009, in draft-williams-tls-app-sasl-opt-03.

It's likely that early start was Martin Rex's idea first.  At one more
more IETF meetings we discussed TLS + GSS-API options extensively in
various IETF jabber rooms (which, IIRC, are archived).

Nico
--

---

From: Martin Rex <[email-masked]>
Date: Fri, 16 Jul 2010 21:11:15 +0200 (MEST)

> various IETF jabber rooms (which, IIRC, are archived).

We also talked about it in Jabber during an IETF Meeting, but
IIRC we discussed it first on the TLS WG mailing list in july 2007,
where I suggested this optimization to cut down on the number of round
trips, since Larry considered the number of round trips very important:

http://www.ietf.org/mail-archive/web/tls/current/msg01911.html
http://www.ietf.org/mail-archive/web/tls/current/msg01917.html

I was applying to TLS the GSS-API v2 "PROT_READY" idea,
which was originally proposed by Bob Blakley in the CAT WG in 1995.

Also, I didn't like the idea of messing with the existing TLS handshake
internals, and favoured to perform the GSS-API handshake immediately
after the TLS handshake (potentially piggy-backing the Finished
messages).

http://www.ietf.org/mail-archive/web/tls/current/msg01906.html

-Martin

---

From: Nicolas Williams <[email-masked]>
Date: Fri, 16 Jul 2010 17:33:01 -0500

> http://www.ietf.org/mail-archive/web/tls/current/msg01906.html

Thanks for the links!  BTW, the jabber logs are here:
http://www.ietf.org/jabber/logs/

I've not searched for them all, but the logs are likely of the krb-wg,
kitten, tls and saag rooms.  Here's a relevant one:

http://www.ietf.org/jabber/logs/tls/2007-07-24.html

Nico
--