Subject: [TLS] A use of flags

From: "Martin Thomson" <[email-masked]>
Date: Wed, 27 Mar 2019 10:35:21 -0400

Inspired by a few side discussions and Yoav's new draft, I have the pleasure of announcing the first proposal to use that mechanism:

 https://tools.ietf.org/html/draft-thomson-tls-sic-00

I'm sure that there are plenty of opportunities to bike shed on the flags format, but it's definitely useful in the abstract.  It make this easier.

( Read the draft for details of the idea.  It's based on the intermediate preloading work we've been doing at Mozilla: https://wiki.mozilla.org/Security/CryptoEngineering/Intermediate_Preloading )

---

From: "Salz, Rich" <[email-masked]>
Date: Wed, 27 Mar 2019 14:39:13 +0000

I would like to define a flag that says "no renegotiation allowed"  This has come up (for pre 1.3 of course) a couple of times, that while you can signal "defaut" or "only secure" renegotiation, you can't signal "no renegotiation" in a way that is visible purely on the wire, to things like SSLLabs ratings systems.

---

From: David Benjamin <[email-masked]>
Date: Wed, 27 Mar 2019 18:19:05 +0100

Is the concern that servers which never renegotiate and do not send any
renegotiation_info are being flagged on ratings systems? That is desired
behavior. See the final paragraph of section 4.3
<https://tools.ietf.org/html/rfc5746#section-4.3>. Those servers should be
sending an empty renegotiation_info. "I never renegotiation" is vacuously
consistent with "all my renegotiations are secure".

This is important because fixing the renegotiation issue requires either:
- The server rejects *all* extension-less renegotiations, or...
- The client rejects *all* extension-less handshakes, including initial
handshakes <https://tools.ietf.org/html/rfc5746#section-4.1>

That second point means that clients cannot protect themselves against
non-strict servers if there are any servers which do not implement at least
the minimal version of the extension. Server implementations which fail to
send the minimal renegotiation_info extension on the initial handshake
should indeed be flagged by ratings systems and fixed.

On Wed, Mar 27, 2019 at 3:39 PM Salz, Rich <[email-masked]> wrote:

> I would like to define a flag that says "no renegotiation allowed"  This
> has come up (for pre 1.3 of course) a couple of times, that while you can
> signal "defaut" or "only secure" renegotiation, you can't signal "no
> renegotiation" in a way that is visible purely on the wire, to things like
> SSLLabs ratings systems.
>
>
>
> _______________________________________________
> TLS mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/tls
>

---

From: Hubert Kario <[email-masked]>
Date: Thu, 28 Mar 2019 14:46:26 +0100

On Wednesday, 27 March 2019 15:35:21 CET Martin Thomson wrote:
> Inspired by a few side discussions and Yoav's new draft, I have the pleasure
> of announcing the first proposal to use that mechanism:
> 

in the situation when the server or client intend to use an "unpublished" 
(term not defined in RFC) the behaviour of them is unspecified

what about resumption and renegotiation?

-- 
Regards,
Hubert Kario
Senior Quality Engineer, QE BaseOS Security team
Web: www.cz.redhat.com
Red Hat Czech s.r.o., Purkyňova 115, 612 00  Brno, Czech Republic

---

From: "Martin Thomson" <[email-masked]>
Date: Fri, 29 Mar 2019 05:24:44 -0400

> what about resumption and renegotiation?

No certificates in resumption.

No resumption in TLS 1.3 (and I don't care about TLS 1.2 any more).

---

From: Andrei Popov <[email-masked]>
Date: Fri, 29 Mar 2019 10:18:20 +0000

> No resumption in TLS 1.3...
You probably mean no renegotiation in TLS 1.3.

-----Original Message-----
From: TLS <[email-masked]> On Behalf Of Martin Thomson
Sent: Friday, March 29, 2019 10:25 AM
To: Hubert Kario <[email-masked]>; [email-masked]
Subject: Re: [TLS] A use of flags

_______________________________________________
TLS mailing list
[email-masked]
https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%2Fmailman%2Flistinfo%2Ftls&amp;data=02%7C01%7CAndrei.Popov%40microsoft.com%7Cb0eec22e1db4492231f408d6b428b219%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636894484211356742&amp;sdata=t0K5DCsx%2FZIV%2Bs7bnUe5lZO0SHtqqCT005GGRAuptUM%3D&amp;reserved=0

---

From: "Martin Thomson" <[email-masked]>
Date: Fri, 29 Mar 2019 09:56:48 -0400

> You probably mean no renegotiation in TLS 1.3.

Of course, thank you.  Not nearly enough sleep this week.