Subject: [TLS] Remove extra 0-RTT content types

From: Eric Rescorla <[email-masked]>
Date: Wed, 21 Oct 2015 15:44:18 -0700

https://github.com/tlswg/tls13-spec/issues/311

I initially added this to make it easier to determine the end of the 0-RTT
handshake if the server had forgotten the key, but with content type
encryption
this is no longer relevant. I propose we remove this and simply use
Handshake here, allowing the keying material to differentiate these.

-Ekr

---

From: Martin Thomson <[email-masked]>
Date: Wed, 21 Oct 2015 15:52:04 -0700

I'm not sure that I follow.  Are all the records in 0RTT going to use
a content of handshake, or just the
Certificate/CertificateVerify/Finished?  I assume that you meant just
the handshake messages, in which case yes, this is OK.  It does make
identification of what goes into the handshake hash marginally more
difficult.

With your client authentication changes, you could just concatenate up
everything with content type of handshake.  Now you have to be a
little more selective.

On 21 October 2015 at 15:44, Eric Rescorla <[email-masked]> wrote:
> _______________________________________________
> TLS mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/tls
>

---

From: Eric Rescorla <[email-masked]>
Date: Wed, 21 Oct 2015 15:52:57 -0700

On Wed, Oct 21, 2015 at 3:52 PM, Martin Thomson <[email-masked]>
wrote:

> the handshake messages, in which case yes, this is OK.

Yes. The application data would be application_data, etc.

> It does make

I don't think this will make the implementation that hard :)

-Ekr

---

From: Martin Thomson <[email-masked]>
Date: Wed, 21 Oct 2015 15:56:49 -0700

> I don't think this will make the implementation that hard :)

Yeah, you have to actually pay attention to the early_data extension.
That might not be a bad thing in the end.

---

From: Eric Rescorla <[email-masked]>
Date: Wed, 21 Oct 2015 16:01:10 -0700

> That might not be a bad thing in the end.

Yes, you do have to.

-Ekr