Subject: [TLS] Draft Agenda for TLS Interim meeting

From: "Joseph Salowey (jsalowey)" <[email-masked]>
Date: Thu, 1 May 2014 18:29:55 +0000

Draft agenda is posted at http://www.ietf.org/proceedings/interim/2014/05/15/tls/agenda/agenda-interim-2014-tls-1 and copied below:

TLS Working Group Interim Meeting
Dates/Times: 
15 May 2014 (9:00 am - 5:00 pm MDT)
16 May 2014 (9:00 am - 2:00 pm MDT)
Location:
1899 Wynkoop Street, Suite 600, Denver, CO, USA

Day 1
-----------------
9:00. Get Settled, Administrivia, Agenda (30 min)
9:30 - 10:30  Fixing Session Resumption (Triple Handshake) (60 Min)
10:30 - 12:30 Encrypt SNI or not (120 min) 
12:30 - 1:30 Lunch
1:30 - 2:00  Wrap up SNI discussion
2:00 - 3:00  Client Puzzles
3:00 - 5:00  Discuss Handshake Flows

Day 2
--------------
9:00 Arrival  
9:30 - 12:30 Discuss Handshake Flows
12:30 - 1:00  Wrap up Handshake discussion
1:00 - 2:00  Summary and next steps

---

From: Watson Ladd <[email-masked]>
Date: Sun, 4 May 2014 18:08:04 -0700

> 1899 Wynkoop Street, Suite 600, Denver, CO, USA

So I unfortunately won't be at the meeting. I do wonder about the
scope: are Session Resumption fixes and Client Puzzles for TLS 1.2 and
prior, or only TLS 1.3? If we are discussing them in the context of
TLS 1.3 then session resumption fixes aren't really a good idea,
depending on how much you want to break.

If you want to break backwards compatibility, then you take a
known-good key exchange and use that. If TLS 1.3 is really TLS 1.2.1:
that is TLS 1.2 with some new extensions added and some options
removed, then patching makes some sense. However, I don't understand
how patching a protocol when you can do a real fix is a good idea, and
so why discuss a particular attack, when you can rule them all out by
making a few simple changes?

(There are good arguments on both sides. Encrypting SNI is likely to
be a break of compatibility, as is Finished changes for analysis
improvements, and cleaning the protocol in general. But breaking
compatibility will slow adoption, and at this point we need
significant adoption of fixes to TLS and workarounds to security
issues. We've also got the general "well, what you really do isn't in
the spec" problem, which makes it difficult to see what's going on)

Sincerely,
Watson Ladd

---

From: Eric Rescorla <[email-masked]>
Date: Sun, 4 May 2014 18:21:05 -0700

On Sun, May 4, 2014 at 6:08 PM, Watson Ladd <[email-masked]> wrote:

> > Draft agenda is posted at
> http://www.ietf.org/proceedings/interim/2014/05/15/tls/agenda/agenda-interim-2014-tls-1and copied below:
> >
> prior, or only TLS 1.3?

The intention is to discuss Session Resumption fixes in the context of
TLS <1.3 as well, since presumably we want people to have security
against triple handshake attacks even if they don't want to upgrade to
the latest version of TLS (no matter how advisable that might otherwise
be.)

Since it's not clear we're going to do client puzzles at all I think it's
probably premature to say which version we might or might not do them
in.

-Ekr