Subject: RE: [TLS] WG review of draft-salowey-tls-ticket-03.txt

From: "Salowey, Joe" <[email-masked]>
Date: Wed, 21 Sep 2005 16:26:56 -0700

Hi Tim,

Thanks for the review.  Comments inline below 

> -----Original Message-----
> From: Tim Dierks [mailto:[email-masked]] 
<snip>
> 
>  - If the server-side implementor screws up his ticket 
> security, it's a catastrophic problem for system security. 
> I'm concerned about creating more possible implementation 
> pitfalls for TLS implementors, especially ones that 
> implicitly ask them to do their own crypto design. I suggest 
> we specify a structure for the ticket, in particular how it 
> is encrypted & authenticated, and recommend use of that 
> structure as a best practice. I think this only requires 
> expanding some language around your example, which looks 
> pretty good. In fact, I'd be open to specifying the example 
> as a part of the standard, with a parenthetical note that, 
> because the contents are opaque to the client, the structure 
> is not subject to interoperability concerns, so implementors 
> can safely diverge from the standard, although they must take 
> security concerns very seriously to do so. (And furthermore, 
> clients must not examine the contents of a ticket under the 
> assumption that the server complies with the standard 
> [although key_version is the only structured unencrypted field].)
> 

[Joe] So would it work to remove the word Sample from the section title
and add text about the opaqueness of the ticket?  

>  - I'm not sure when the new message with the ticket should be sent.
> Because the server cannot easily revoke a ticket that has 
> been sent, the ticket shouldn't be transmitted until the 
> server is willing to commit to the session's validity and 
> accuracy. The current location (after client sends Finished, 
> but before server sends Finished) seems OK, but I believe it 
> should be specified that the ticket should not be sent until 
> the server validates the client's Finished message: I don't 
> have an exact attack, but this seems prudent.
> 

[Joe] Yup, I agree. 

>  - We should specify the exact behavior if a server accepts a 
> ticket, but the connection then fails to complete and 
> validate: the client must discard the ticket.
> 

[Joe] OK 

>  - Can the server send NewSessionTicket on a resumed session? 
> I'm sure people will want to do this at some point, because 
> they'll be storing something in the ticket they want to 
> update (last connection time, for example).
> 

[Joe] OK, this sounds like a good improvement, I don't see a problem
with doing it.  

>  - Tim
> 
> On 9/12/05, Eric Rescorla <[email-masked]> wrote:
> > Nelson B Bolyard <[email-masked]> writes:
> >
> > > Eric Rescorla wrote:
> > >> A while back I asked whether there was WG enthusiasm for
> > >> draft-salowey-tls-ticket-03 and while there seemed to be some 
> > >> interest, there wasn't enough in my opinion to justify 
> making it a 
> > >> WG work item.
> > >>
> > >> Accordingly, I asked Joe to go ahead with it as an individual 
> > >> submission. He has now prepared a new version which he feels is 
> > >> ready to submit to the IESG. Because this is a modification to a 
> > >> core TLS mechanism I would like to get some review from 
> the TLS WG. 
> > >> Can I please get 3 volunteers who will commit having reviews of 
> > >> this document by October 1?
> > >
> > > I volunteer to review
> > > 
> http://www.ietf.org/internet-drafts/draft-salowey-tls-ticket-04.txt
> > > this month.
> > >
> > > I'm assuming the various volunteer reviewers would like 
> to read each 
> > > others' reviews.  Shall we use this mailing list to discuss it?
> >
> > Please.
> >
> >
> > > Is Joe on this mailing list?
> > > Or, Shall we form another list to discuss it?
> > > Or will someone inform us of the other reviewers so that 
> we can CC 
> > > the others?
> >
> > I'll post a list once I get three.
> >
> > Only one person has volunteered so far. Can I please get two more 
> > volunteers?
> >
> > thanks,
> > -Ekr
> >
> >
> > _______________________________________________
> > TLS mailing list
> > [email-masked]
> > https://www1.ietf.org/mailman/listinfo/tls
> >
> 
> _______________________________________________
> TLS mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/tls
> 

_______________________________________________
TLS mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/tls

---

From: Tim Dierks <[email-masked]>
Date: Thu, 22 Sep 2005 15:53:45 -0400

> and add text about the opaqueness of the ticket?

I think it probably takes a little more wordsmithing that that, but
that's the drift.

 - Tim