Subject: [TLS] WG adoption call for draft-tschofenig-tls-dtls-rrc: redux

From: Sean Turner <[email-masked]>
Date: Mon, 3 May 2021 11:44:48 -0400

Hi!

We would like to re-run the WG adoption call for "Return Routability Check for DTLS 1.2 and DTLS 1.3”. Please state whether you support adoption of this draft as a WG item by posting a message to the TLS list by 2359 UTC 24 May 2021.  Please include any additional information that is helpful in understanding your position.

NOTES:

1) We are re-running this WG adoption now that DTLS 1.3 [1] and Connection Identifiers for DTLS 1.2 [2] is done.
2) Here is a link to the original WG adoption call [3].

Thanks,
Chris, Joe, and Sean

[1] https://datatracker.ietf.org/doc/draft-ietf-tls-dtls13/
[2] https://datatracker.ietf.org/doc/draft-ietf-tls-dtls-connection-id/
[3] https://mailarchive.ietf.org/arch/msg/tls/IJYqpTmSHsCkiMaUPt_AltvKbe8/

---

From: Achim Kraus <[email-masked]>
Date: Tue, 4 May 2021 11:42:13 +0200

Hello Sean,
Hello List,

FMPOV, that dtls-rrc work is very welcome!
All use-cases, where the northbound-layers don't provide solutions for
that, will benefit from it.

best regards
Achim Kraus

Am 03.05.21 um 17:44 schrieb Sean Turner:
> _______________________________________________
> TLS mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/tls
>

---

From: Simon Bernard <[email-masked]>
Date: Tue, 4 May 2021 12:34:57 +0200

I support adoption. It should be useful to deal with this issue at DTLS 
level.

---

From: "Salz, Rich" <[email-masked]>
Date: Tue, 4 May 2021 18:11:29 +0000

I'm not a strong DTLS expert, but this seems like important work.  We should adopt it.  I promise to read and review.

---

From: Russ Housley <[email-masked]>
Date: Tue, 4 May 2021 14:12:07 -0400

This document seems fine to me, but the first paragraph of Section 3 needs some work.  This can be sorted out after adoption.

Section 3 begins with:

   When a record with CID is received that has the source address of the
   enclosing UDP datagram different from the one previously associated
   with that CID, the receiver MUST NOT update its view of the peer's IP
   address and port number with the source specified in the UDP datagram
   before cryptographically validating the enclosed record(s) but
   instead perform a return routability check.

I agree that the return routability check should be performed before updating the peer's IP address and port number, but I the part about "before cryptographically validating the enclosed record" seems to open up some opportunities for trouble.

Russ

> On May 3, 2021, at 11:44 AM, Sean Turner <[email-masked]> wrote:
> 
> Hi!
>

---

From: "Martin Thomson" <[email-masked]>
Date: Wed, 05 May 2021 12:52:52 +1000

What Russ said here is important.  However, I don't see any reason that this record should not be protected.

I also think that we can use a content type outside of the scarce range we have for TLS record content types.  This only makes sense for use with DTLS 1.3 and DTLS 1.2 with connection IDs, so we can rely on the content type being encrypted.  That means multiplexing constraints don't apply (they probably wouldn't anyway as this makes no sense for use with ICE).

Finally, I think that the flexible size of the cookie is not necessary.  Pick a fixed size.  Unlike the handshake cookie, there is no reason for this to be stateless.  (I also wouldn't call it a cookie.)

The comments that Martin Duke currently has on the connection ID regarding path validation rules apply more fully here than they do on that draft.  Perhaps we could fix them here.

On Wed, May 5, 2021, at 04:12, Russ Housley wrote:
> This document seems fine to me, but the first paragraph of Section 3 
> needs some work.  This can be sorted out after adoption.
> 
> Section 3 begins with:
> 
> I agree that the return routability check should be performed before 
> updating the peer's IP address and port number, but I the part about 
> "before cryptographically validating the enclosed record" seems to open 
> up some opportunities for trouble.
> 
> Russ
> 
>

---

From: Thomas Fossati <[email-masked]>
Date: Wed, 5 May 2021 15:49:12 +0000

On 03/05/2021, 16:46, "Sean Turner" <[email-masked]> wrote:
> Hi!
>
> We would like to re-run the WG adoption call for "Return Routability
> Check for DTLS 1.2 and DTLS 1.3”. Please state whether you support
> adoption of this draft as a WG item by posting a message to the TLS
> list by 2359 UTC 24 May 2021.  Please include any additional
> information that is helpful in understanding your position.
>
> NOTES:
>
> 1) We are re-running this WG adoption now that DTLS 1.3 [1] and
>    Connection Identifiers for DTLS 1.2 [2] is done.

+1 for adoption (the same considerations stated at the time of the
previous CfA [0] hold.)

[0] https://mailarchive.ietf.org/arch/msg/tls/ZoHz7u9SaCURvvJNaWLDlA9--YE/

IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.

---

From: Hannes Tschofenig <[email-masked]>
Date: Thu, 6 May 2021 08:58:15 +0000

Hi Sean,

Thanks for keeping track of the backlog of drafts.

I am still interested to do this work and I contributed to the draft because a generic mechanism for doing the return routability check is better than pushing the responsibility to the application layer. There is always the risk that application developers impact security properties unintentionally.

Ciao
Hannes

-----Original Message-----
From: TLS <[email-masked]> On Behalf Of Sean Turner
Sent: Monday, May 3, 2021 5:45 PM
To: TLS List <[email-masked]>
Subject: [TLS] WG adoption call for draft-tschofenig-tls-dtls-rrc: redux

Hi!

NOTES:

Thanks,
Chris, Joe, and Sean

---

From: Sean Turner <[email-masked]>
Date: Fri, 28 May 2021 09:13:37 -0400

Hi!

It appears the we have consensus to adopt this I-D as a WG item.

I will work with the authors to establish the GH repo and get the I-D submitted as a WG item.

spt (for the chairs)

> On May 3, 2021, at 11:44, Sean Turner <[email-masked]> wrote:
> 
> Hi!
>