Re: [TLS] Adam Roach's No Objection on draft-ietf-tls-ecdhe-psk-aead-04: (with COMMENT)

2017-05-24 Thread Daniel Migault
Hi Adam, The text you mention is from version 04. Version 05 has been submitted, but is somewhere in the datatracker. For some reason I am not able to confirm the submission, so I have attached it to my response to Eric. The text of the current version 05 is: Yours, Daniel """ 4. Applicable T

Re: [TLS] Security review of TLS1.3 0-RTT

2017-05-24 Thread Benjamin Kaduk
On 05/21/2017 05:47 PM, Eric Rescorla wrote: > > > On Sat, May 20, 2017 at 6:16 AM, Ilari Liusvaara > mailto:ilariliusva...@welho.com>> wrote: > > On Fri, May 19, 2017 at 09:59:57AM -0700, Colm MacCárthaigh wrote: > > > - Clients MUST NOT use the same ticket multiple times for 0-RTT.

Re: [TLS] Eric Rescorla's Discuss on draft-ietf-tls-ecdhe-psk-aead-04: (with DISCUSS and COMMENT)

2017-05-24 Thread Daniel Migault
Hi Martin, Thank you for your review. Some comment were about text in the applicability section. I think I agree with you that this section details and clarifies the following sentence of the previous section: """ The assigned code points can only be used for TLS 1.2.""". Most of the text of thi

Re: [TLS] Security review of TLS1.3 0-RTT

2017-05-24 Thread Ilari Liusvaara
On Wed, May 24, 2017 at 08:50:07AM -0500, Benjamin Kaduk wrote: > On 05/21/2017 05:47 PM, Eric Rescorla wrote: > > > > > > On Sat, May 20, 2017 at 6:16 AM, Ilari Liusvaara > > mailto:ilariliusva...@welho.com>> wrote: > > > > On Fri, May 19, 2017 at 09:59:57AM -0700, Colm MacCárthaigh wrote: > >

Re: [TLS] Eric Rescorla's Discuss on draft-ietf-tls-ecdhe-psk-aead-04: (with DISCUSS and COMMENT)

2017-05-24 Thread Joseph Salowey
Hi Daniel, Thanks for putting this revision together. The original text in draft 4 went beyond the scope of what should be in the document (I was too hasty in my review of the document and discussion on the list). Your current proposal is an improvement, but it still discusses behavior that cou

Re: [TLS] [Gen-art] Genart telechat review of draft-ietf-tls-ecdhe-psk-aead-04

2017-05-24 Thread Alissa Cooper
Dan, thank you for your reviews of this document and thanks to the authors for providing clarifications. I have balloted No Objection. Alissa > On May 19, 2017, at 6:43 PM, Dan Romascanu wrote: > > Reviewer: Dan Romascanu > Review result: Ready > > I am the assigned Gen-ART reviewer for this

Re: [TLS] Security review of TLS1.3 0-RTT

2017-05-24 Thread Colm MacCárthaigh
On Wed, May 24, 2017 at 7:30 AM, Ilari Liusvaara wrote: > > > Right, this would bring replays down from the millions hypothesized for > > the weak time-based thing to more like tens, which is kind of in the > > regime that we are currently in with (at least some) application > behavior. > > Actual

Re: [TLS] Eric Rescorla's Discuss on draft-ietf-tls-ecdhe-psk-aead-04: (with DISCUSS and COMMENT)

2017-05-24 Thread Daniel Migault
Hi, Thank Joe for the clarification. I removed section 4 and instead have the following section 3. This is the version 06. I will post it as soon as the datatracker allows me to submit a new version, so please let me know if that address all concerns. Yours, Daniel 3. ECDHE_PSK with AES-GCM an

Re: [TLS] Security review of TLS1.3 0-RTT

2017-05-24 Thread Benjamin Kaduk
On 05/24/2017 10:32 AM, Colm MacCárthaigh wrote: > > > Another crazy idea would be to just say that servers MUST limit > the use > > of a single binder to at most 100 times, with the usual case > being just > > once, to allow for alternative designs that have weaker distributed

Re: [TLS] Eric Rescorla's Discuss on draft-ietf-tls-ecdhe-psk-aead-04: (with DISCUSS and COMMENT)

2017-05-24 Thread Martin Thomson
On 25 May 2017 at 00:04, Daniel Migault wrote: > B) It is not true as TLS1.3 enables these cipher suites to be negotiated > with TLS1.3. You can't negotiate the new suites with 1.3, but you can offer them in case the server picks 1.2. Joe's proposal fixes this and other errors. >> You don't a

[TLS] Spencer Dawkins' No Objection on draft-ietf-tls-ecdhe-psk-aead-04: (with COMMENT)

2017-05-24 Thread Spencer Dawkins
Spencer Dawkins has entered the following ballot position for draft-ietf-tls-ecdhe-psk-aead-04: No Objection When responding, please keep the subject line intact and reply to all email addresses included in the To and CC lines. (Feel free to cut this introductory paragraph, however.) Please refe

Re: [TLS] Spencer Dawkins' No Objection on draft-ietf-tls-ecdhe-psk-aead-04: (with COMMENT)

2017-05-24 Thread Kathleen Moriarty
On Wed, May 24, 2017 at 4:49 PM, Spencer Dawkins wrote: > Spencer Dawkins has entered the following ballot position for > draft-ietf-tls-ecdhe-psk-aead-04: No Objection > > When responding, please keep the subject line intact and reply to all > email addresses included in the To and CC lines. (Fee

Re: [TLS] Eric Rescorla's Discuss on draft-ietf-tls-ecdhe-psk-aead-04: (with DISCUSS and COMMENT)

2017-05-24 Thread Joseph Salowey
On Wed, May 24, 2017 at 1:13 PM, Martin Thomson wrote: > On 25 May 2017 at 00:04, Daniel Migault > wrote: > > > B) It is not true as TLS1.3 enables these cipher suites to be negotiated > > with TLS1.3. > > You can't negotiate the new suites with 1.3, but you can offer them in > case the server p

Re: [TLS] Eric Rescorla's Discuss on draft-ietf-tls-ecdhe-psk-aead-04: (with DISCUSS and COMMENT)

2017-05-24 Thread Martin Thomson
On 25 May 2017 at 07:14, Joseph Salowey wrote: > [Joe] It seems that a reasonable interpretation of the text is that the AEAD > constructs will pair with the cipher suite that share the same name. Do you > still think we need to provide an explicit mapping between the two? Reasonable, sure, eve

Re: [TLS] [Gen-art] Genart telechat review of draft-ietf-tls-ecdhe-psk-aead-04

2017-05-24 Thread Joseph Salowey
Hi Dan and Alissa, There has been some churn in the text of the document due to my oversight when sending the document to the IESG. The proposed new text provided below show should also resolve your comment. Please let me know if you see any issues with this approach. Thanks, Joe Replacing s

Re: [TLS] Eric Rescorla's Discuss on draft-ietf-tls-ecdhe-psk-aead-04: (with DISCUSS and COMMENT)

2017-05-24 Thread Daniel Migault
>From your response I understand you do not request changes. Yours, Daniel On Wed, May 24, 2017 at 4:24 PM, Martin Thomson wrote: > On 25 May 2017 at 07:14, Joseph Salowey wrote: > > [Joe] It seems that a reasonable interpretation of the text is that the > AEAD > > constructs will pair with the

Re: [TLS] Spencer Dawkins' No Objection on draft-ietf-tls-ecdhe-psk-aead-04: (with COMMENT)

2017-05-24 Thread Daniel Migault
Thanks Spencer for your review. Actually the scope has always been TLS1.2 only. I confirm version 05 have addressed Erik's comments. Yours, Daniel On Wed, May 24, 2017 at 4:03 PM, Kathleen Moriarty < kathleen.moriarty.i...@gmail.com> wrote: > On Wed, May 24, 2017 at 4:49 PM, Spencer Dawkins > wr

Re: [TLS] [Gen-art] Genart telechat review of draft-ietf-tls-ecdhe-psk-aead-04

2017-05-24 Thread Dan Romascanu
Hi Joe, Looks OK, but don't you need to also drop 'as well as version 1.3 of TLS' from the first paragraph in the Introduction? Regards, Dan On Thu, May 25, 2017 at 12:29 AM, Joseph Salowey wrote: > Hi Dan and Alissa, > > There has been some churn in the text of the document due to my oversig

Re: [TLS] Eric Rescorla's Discuss on draft-ietf-tls-ecdhe-psk-aead-04: (with DISCUSS and COMMENT)

2017-05-24 Thread Martin Thomson
On 25 May 2017 at 07:43, Daniel Migault wrote: > From your response I understand you do not request changes. I am requesting changes. Just say that TLS_ECDHE_PSK_WITH_AES_128_GCM_SHA256 uses AEAD_AES_128_GCM, and so forth. It's not hard to be explicit. _

Re: [TLS] [Gen-art] Genart telechat review of draft-ietf-tls-ecdhe-psk-aead-04

2017-05-24 Thread Daniel Migault
Hi Dan, The major concern we have is that as a response to your comment I detailed how the defined cipher suites are agreed with TLS1.3. The text we agreed on has been updated, but I guess it still provides enough details. In addition, you are right, we have also clarified the text and make sure

Re: [TLS] [Gen-art] Genart telechat review of draft-ietf-tls-ecdhe-psk-aead-04

2017-05-24 Thread Dan Romascanu
Thanks. This clarifies now. Regards, Dan Sent from my iPhone > On 25 May 2017, at 1:49, Daniel Migault wrote: > > Hi Dan, > > The major concern we have is that as a response to your comment I detailed > how the defined cipher suites are agreed with TLS1.3. The text we agreed on > has been