[TLS] DTLS epoch and resume session/handshake

2015-07-31 Thread Simon Bernard
Hi, I search in DTLS RFC 6347 if the epoch should be (re)set to 0 when we start a resume handshake, or if we keep the last used value, or the last used value+1 ? I can not any clue of that in the spec. Any idea ? Thx Simon ___ TLS mailing list

Re: [TLS] DTLS epoch and resume session/handshake

2015-07-31 Thread Eric Rescorla
The epoch is set to 0 at the start of each connection and then incremented with each handshake on that connection. -Ekr On Fri, Jul 31, 2015 at 4:41 PM, Simon Bernard wrote: > Hi, > > I search in DTLS RFC 6347 if the epoch should be (re)set to 0 when we > start a resume handshake, or if we ke

Re: [TLS] Computation of static secret in anonymous DH

2015-07-31 Thread Ilari Liusvaara
On Fri, Jun 26, 2015 at 01:41:29PM -0500, Nico Williams wrote: > > tls-unique depends on the Finished message strongly binding the entire > transcript up to that point. I find this elegant (despite the > resumption problem, which anyways, should be fixed by the session hash) > and easy to underst

Re: [TLS] Computation of static secret in anonymous DH

2015-07-31 Thread Nico Williams
On Fri, Jul 31, 2015 at 07:42:12PM +0300, Ilari Liusvaara wrote: > On Fri, Jun 26, 2015 at 01:41:29PM -0500, Nico Williams wrote: > > tls-unique depends on the Finished message strongly binding the entire > > transcript up to that point. I find this elegant (despite the > > resumption problem, whi

Re: [TLS] Fwd: Summary of today's discussion on server-side signing

2015-07-31 Thread Hugo Krawczyk
I am ok with whatever the WG decides, particularly when the reasons are non-cryptographic but rather based on implementation considerations. Still, for the record, I'd like to correct the statement " ​ KnownConfiguration is only useful with 0-RTT. ​"​. KnownConfiguration could be used with 1-RTT

Re: [TLS] Fwd: Summary of today's discussion on server-side signing

2015-07-31 Thread Eric Rescorla
On Fri, Jul 31, 2015 at 5:56 PM, Hugo Krawczyk wrote: > I am ok with whatever the WG decides, particularly when the reasons are > non-cryptographic but rather based on implementation considerations. > > Still, for the record, I'd like to correct the statement " > ​ > KnownConfiguration is only us