Subject: [TLS] Martin Vigoureux's No Objection on draft-ietf-tls-record-limit-02: (with COMMENT)

From: Martin Vigoureux <[email-masked]>
Date: Thu, 05 Apr 2018 02:31:11 -0700

Martin Vigoureux has entered the following ballot position for
draft-ietf-tls-record-limit-02: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-tls-record-limit/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

Hello, I'm not a TLS expert so please disregard if this is irrelevant.
Document says:
   Clients that depend on having a small record size MAY continue to
   advertise the "max_fragment_length".

Do you mean:
   Clients that depend on having a small record size MAY continue to
   advertise the "max_fragment_length" *only*.

If so, what would be the behaviour of a server that supports both
"max_fragment_length" and "record_size_limit" in that situation?

---

From: Martin Thomson <[email-masked]>
Date: Thu, 5 Apr 2018 20:28:54 +1000

>    advertise the "max_fragment_length" *only*.

It's "also".  The idea being that if you aren't sure if the server
supports the new thing, you might offer the old thing in addition to
the new thing in the hopes that if the new thing isn't supported, the
old thing might be.

> "max_fragment_length" and "record_size_limit" in that situation?

If you don't include record_size_limit, you can't use it.  If the
client includes both, then the text from the preceding paragraph
applies: "A server that supports the record_size_limit extension MUST
ignore a max_fragment_length that appears in a ClientHello if both
extensions appear."

---

From: Martin Vigoureux <[email-masked]>
Date: Thu, 5 Apr 2018 15:35:41 +0200

Martin,

thanks for the quick reply. That clarifies.
I asked because the paragraph above that sentence somehow already 
implies that clients may continue advertise the "max_fragment_length" 
(at least that's ow I understand it), so I felt that this sentence must 
mean something different.

-m