Subject: [TLS] TLS Paris Interim Minutes

From: Sean Turner <[email-masked]>
Date: Tue, 4 Nov 2014 20:39:48 -0500

Posted draft minutes:

http://www.ietf.org/meeting/interim/proceedings.html

spt

---

From: Bodo Moeller <[email-masked]>
Date: Wed, 5 Nov 2014 13:49:07 +0100

Sean Turner <[email-masked]>:

> http://www.ietf.org/meeting/interim/proceedings.html

My corrections to the previous draft (for Day 1) still apply:

1.

The link
https://github.com/tlswg/wg-materials/blob/master/20141021_interim/TLS_FALLBACK_SCSV_IETF_TLS_Interim_Oct_2014.pdf
should be replaced by
http://www.ietf.org/proceedings/interim/2014/10/21/tls/slides/slides-interim-2014-tls-3-1.pdf
.

2.

Mention that youtube encodes video streams using RC4 only.

This isn't correct, and isn't what was said at the meeting. As discussed at
the meeting, YouTube currently allows two cipher suites for video streams,
TLS_RSA_WITH_AES_128_GCM_SHA256 and TLS_RSA_WITH_RC4_128_SHA, but Firefox
doesn't support the former without ECDHE (
https://bugzilla.mozilla.org/show_bug.cgi?id=1029179).

Bodo

---

From: Manuel Pégourié-Gonnard <[email-masked]>
Date: Wed, 05 Nov 2014 13:55:58 +0100

On 05/11/2014 13:49, Bodo Moeller wrote:
> This isn't correct, and isn't what was said at the meeting.

As the person who raised that point at the meeting, I agree that this is not
what was said at the meeting (and not correct either).

Unrelated point: I think the last three lines (starting with "----") should be
removed as they are not related to the meeting (it looks like something about
PolarSSL that Hannes and I discussed on the day of the meeting).

Manuel.

---

From: Adam Langley <[email-masked]>
Date: Wed, 5 Nov 2014 06:18:45 -0800

On Wed, Nov 5, 2014 at 4:49 AM, Bodo Moeller <[email-masked]> wrote:
> doesn't support the former without ECDHE
> (https://bugzilla.mozilla.org/show_bug.cgi?id=1029179).

Some locations additionally support ECDHE_RSA_AES_128_GCM_SHA256,
which we are testing now.

Cheers

AGL

---

From: Bodo Moeller <[email-masked]>
Date: Wed, 5 Nov 2014 15:56:00 +0100

> which we are testing now.

Yes, but the above is about correcting the 2014-10-21 minutes, not updating
them to reflect the current status.

Bodo

---

From: Sean Turner <[email-masked]>
Date: Wed, 5 Nov 2014 18:06:20 -0500

On Nov 05, 2014, at 09:56, Bodo Moeller <[email-masked]> wrote:

> Yes, but the above is about correcting the 2014-10-21 minutes, not updating them to reflect the current status.
> 
> Bodo

I’ll make sure these get updated.

spt

---

From: Hugo Krawczyk <[email-masked]>
Date: Thu, 6 Nov 2014 11:51:57 +0200

Let me also clarify the following point from the minutes:

> The construct presented by Hugo was from the SKEME paper published in
'91: http://webee.technion.ac.il/~hugo/skeme-lncs.ps

I referred to the paper when answering the question of whether this is a
new design. I said that a similar design goes back to the above paper (from
NDSS'96 not 91) which had actually many of the same motivations than the
current proposal (PFS, identity protection, a uniform treatment of
pre-shared key and re-key, etc). On the other hands, there are some
significant differences in the new proposal such as the support of 0-RTT
and server-only authentication. In cryptography little changes can
introduce vulnerabilities so OPTLS needs to be considered as a new design
for the sake of analysis (and there are important details to be nailed
down, especially the key derivation definitions).

Hugo

On Thu, Nov 6, 2014 at 1:06 AM, Sean Turner <[email-masked]> wrote:

> > Yes, but the above is about correcting the 2014-10-21 minutes, not
> updating them to reflect the current status.
> >
> > Bodo
>
> _______________________________________________
> TLS mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/tls
>

---

From: Sean Turner <[email-masked]>
Date: Mon, 24 Nov 2014 17:16:12 -0500

I updated interim minutes to incorporate your changes.

spt

On Nov 06, 2014, at 04:51, Hugo Krawczyk <[email-masked]> wrote:

> > The construct presented by Hugo was from the SKEME paper published in '91: http://webee.technion.ac.il/~hugo/skeme-lncs.ps
> 
> I referred to the paper when answering the question of whether this is a new design. I said that a similar design goes back to the above paper (from NDSS'96 not 91) which had actually many of the same motivations than the current proposal (PFS, identity protection, a uniform treatment of pre-shared key and re-key, etc). On the other hands, there are some significant differences in the new proposal such as the support of 0-RTT and server-only authentication. In cryptography little changes can introduce vulnerabilities so OPTLS needs to be considered as a new design for the sake of analysis (and there are important details to be nailed down, especially the key derivation definitions).
> 
> Hugo
> 
>