Subject: [TLS] WGLC for draft-ietf-tls-ecdhe-psk-01.txt

From: Eric Rescorla <[email-masked]>
Date: Fri, 16 May 2008 08:14:02 -0700

This is a Working Group Last Call for:

   ECDHE_PSK Ciphersuites for Transport Layer Security (TLS)  
   draft-ietf-tls-ecdhe-psk-01.txt 

The intended status of this document is Informational.

Please provide any comments on this draft by Friday May 30.

-Ekr
[As WG co-chair]
_______________________________________________
TLS mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/tls

---

From: <[email-masked]>
Date: Mon, 26 May 2008 15:11:02 +0300

<speaking as AD> 
If you're going allocate a bunch of CipherSuite numbers that combine
ECC and PSK, putting all of them in a single document would greatly
reduce the process overhead for everyone. I was *not* amused when I 
heard that there might be another document similar to this one 
coming soon...

<speaking as individual>
The document is simple and looks good. I have one editorial
suggestion to improve clarity:

In Section 2, the premaster secret involves two different secrets that
are shared between the peers. To be totally clear which is meant at
what time, it could be rephrased something like this:

   The premaster secret is formed as follows.  First, perform the ECDH
   computation as described in Section 5.10 of [RFC4492]. Let Z be the
   octet string produced by this computation. Next, concatenate a
   uint16 containing the length of Z (in octets), Z itself, a uint16
   containing the length of the PSK (in octets), and the PSK itself.

   This corresponds to the general structure for the premaster secrets
   (see Note 1 in Section 2 of [RFC4279]), with "other_secret"
   containing Z.

Best regards,
Pasi

---

From: Mohamad Badra <[email-masked]>
Date: Mon, 26 May 2008 14:37:48 +0200

Dear Pasi,

> heard that there might be another document similar to this one 

As I said in a past email, putting all of these ciphersuites in a sinle 
document may IMO introduce some confusion since a subset of them may 
only be used in TLS1.2 or greater. If this is not the case for you and 
for the WG, I haven't any problem with your suggestion.

>    (see Note 1 in Section 2 of [RFC4279]), with "other_secret"

OK, I will update the text, but I am a little bit confused on using the 
parameter Z or not; especially because you recommanded me to be 
consistent with RFC4492 :)

(http://www.imc.org/ietf-tls/mail-archive/msg07884.html)
Section 2, "Let Z be the value produced by this computation",
Elliptic Curve Diffie-Hellman is somewhat different in this
respect; text should be consistent with RFC 4492 Section 5.10.

> Pasi 

Best regards,
Badra

---

From: <[email-masked]>
Date: Mon, 26 May 2008 15:48:17 +0300

Mohamad Badra wrote:

> As I said in a past email, putting all of these ciphersuites in a
> sinle document may IMO introduce some confusion since a subset of
> them may only be used in TLS1.2 or greater. If this is not the case
> for you and for the WG, I haven't any problem with your suggestion.

I think such confusion can be addressed by suitable organization
inside the document (e.g. putting those cipher suites that work
only with TLS 1.2 in separate sections).

<snip>
> OK, I will update the text, but I am a little bit confused on using
> the parameter Z or not; especially because you recommanded me to be

The problem with the earlier version was that it was unclear how the
result of the computation (a point on the curve, often represented
with two coordinates) is converted to an octet string. Citing 
RFC 4492 Section 5.10 fixed that part.

Best regards,
Pasi

---

From: "Blumenthal, Uri" <[email-masked]>
Date: Mon, 26 May 2008 17:50:24 -0400

My opinion - relevant cipher-suites must be all in a single document.  Thanks!
--
Regards,
Uri       [email-masked]