Subject: Re: [TLS] TLS 1.3 process

From: Peter Gutmann <[email-masked]>
Date: Sat, 29 Mar 2014 06:32:07 +0000

Stephen Farrell <[email-masked]> writes:

>I'm sure others who were more involved will correct me, but wasn't the IKEv1
>fun in large part caused by not being able to pick a winner from not-hugely-
>different competing proposals, with a sprinkling of not easily handled
>personalities and other competing interests involved?

>From Jeff Schiller's comment and recollections by others who were involved it
was more a problem of politics, the authors of Photuris were either difficult
to work with or unwilling to compromise their elegant design depending on
which side you're on so Photuris couldn't be used, SKIP was from Sun so that
couldn't be used, and the result was a design-by-committee mess.

Also, the solution isn't necessarily a competition per se but the way that the
competition channels the design.  What's needed is an elegant design created
by a very small number of talented people, not the outcome of several years of
horse-trading put in an RFC.  Look at all of the successful mainstream
Internet security protocols: SSL, three people.  S/MIME, two(?) people.  PGP,
one person. SSH... well, it started out with a small number of people at
SSH.com and then got hacked and kludged endlessly, but close enough.

The competition format more or less requires the "small group of talented
individuals" design, you can't submit a design-by-committee entry to a
competition because (a) a committee will never agree on a single design before
the competition closes and (b) the committee design will be such a mess that
it'll never get picked.

My preference (which I've expressed off-list) would be just to take SKEME,
come up with a single unambiguous profile for it (not the kitchen-sink IPsec
interpretation), and call that TLS 2.0.  The crypto framework is already
there, you just need to provide a wire format for it and nail down a single
interpretation that everyone speaks.

Peter.

---

From: Peter Gutmann <[email-masked]>
Date: Sat, 29 Mar 2014 06:38:31 +0000

Nikos Mavrogiannopoulos <[email-masked]> writes:

>However, the majority of the TLS protocol was designed outside the IETF
>processes, and the result I believe was more than satisfactory.

As was S/MIME, PGP, and early drafts of SSH (and by "SSH" I mean SSHv2
obviously).  The IETF just took over a more or less complete design wholesale
and went with it.  Of the major Internet security protocols, the only one that
was done via the IETF process was, uh, IPsec.

Peter.

---

From: Peter Gutmann <[email-masked]>
Date: Sat, 29 Mar 2014 06:49:26 +0000

Adam Langley <[email-masked]> writes:

>I would rather like to see a TLS 1.3 that is a tidying up of 1.2: merging the
>various RFCs into one, editing and pulling in some of the drafts that are
>floating around. The more significant changes could be 1.4.

Absolutely!  I don't want to have to add yet another parallel implementation
of a protocol that's just different enough that it's yet another set of code
and functionality to test, alongside SSLv3, TLS 1.0, and TLS 1.2.  All of the
previous updates have been compatible enough that you don't want to do a new
implementation, but incompatible enough that it's a different protocol.  Make
1.3 purely fixes for 1.2 and then start again with 2.0 so we can ditch all the
old baggage, complexity, and attack surface.

Peter.

---

From: Peter Gutmann <[email-masked]>
Date: Mon, 31 Mar 2014 09:07:21 +0000

Dan Harkins <[email-masked]> writes:

>[...]

I think Bill Frantz has already responded to everything in your message...

Peter.