Subject: Security of alternative handshakes

From: Watson Ladd <[email-masked]>
Date: Wed, 21 Apr 2021 21:11:26 -0700

Dear WG,

After the meeting I was thinking through the security of version
negotiation and I realized that there is a wrinkle with the way TLS
and QUIC are layered, and proposals such as noise-QUIC. And that
wrinkle is that while TLS is secure, and noise-QUIC is secure, nothing
says that they are secure together when using the same PKI information
or negotiate well together. With TLS 1.3 we finally added domain
separation to what is signed, but one hopes protocol X does the same
but different.

The other wrinkle is that so far with TLS we've had a pretty uniform
idea of how transport parameters feed into the handshake, and thus
assurance that they are actually implicitly authenticated by the
finished messages and agreed upon. With an alternate handshake that
goes away.

Sincerely,
Watson Ladd
-- 
Astra mortemque praestare gradatim

---

From: "Martin Thomson" <[email-masked]>
Date: Thu, 22 Apr 2021 14:38:22 +1000

On Thu, Apr 22, 2021, at 14:11, Watson Ladd wrote:
> With TLS 1.3 we finally added domain

Good catch Watson.  This is an important assumption to state.

Opened: https://github.com/quicwg/version-negotiation/issues/36

> finished messages and agreed upon. With an alternate handshake that

I think that we have this one covered at least.  We require that the cryptographic handshake authenticate the transport parameters: https://quicwg.org/base-drafts/draft-ietf-quic-transport.html#section-7-3.2