Subject: [TLS] Draft 18 review : 0-RTT

From: Olivier Levillain <[email-masked]>
Date: Tue, 22 Nov 2016 20:07:22 +0100

Hi list,

I am sorry for the very late answer concerning draft 18, but we
(ANSSI) have several remarks after proof-reading the current
specification.

We are sorry for the multiple long messages.

If the WG is interested by some of our concerns/proposals, we would be
glad to propose some PRs.

= 0-RTT =

In 4.2.8 (P.47), the server receiving early_data "can behave in one of
two ways"... followed by three cases.  Beside the typo, the first case
could be phrased differently.  Actually, it reads

   -  Ignore the extension and return no response.  This indicates that
      the server has ignored any early data and an ordinary 1-RTT
      handshake is required.

Since an ordinary 1-RTT handshake will require the server to actually
send a response (the ServerHello), it might be better to put it this
way:

   -  Ignore the extension and return a standard 1-RTT ServerHello.
      This indicates that the server has ignored any early data and
      an ordinary 1-RTT handshake is required.

Olivier Levillain

---

From: Martin Thomson <[email-masked]>
Date: Wed, 23 Nov 2016 11:28:15 +1100

>       an ordinary 1-RTT handshake is required.

Here's a PR: https://github.com/tlswg/tls13-spec/pull/773

I've gone a little bit further than what Olivier suggests and pointed
out in each of these that the server is required to ignore early data.

---

From: Olivier Levillain <[email-masked]>
Date: Wed, 23 Nov 2016 09:53:31 +0100

> out in each of these that the server is required to ignore early data.

Thank you for the rewrite.

olivier