Subject: [TLS] 'Type B' Extensions (was Re: Pull request for 1RTT Handshake)

From: Tom Ritter <[email-masked]>
Date: Sat, 5 Jul 2014 08:47:29 -0400

On 4 July 2014 23:30, Watson Ladd <[email-masked]> wrote:
> Also, I don't recall having seen
> 'type B extensions': what was the rationale? How was the answer going
> to come back?)

They've not been mentioned before because they haven't really been
presented for discussion.  They're buried in here:
http://www.ietf.org/proceedings/interim/2014/05/15/tls/slides/slides-interim-2014-tls-1-4.pdf
and they're not that important right now, in comparison to other
changes like 1RTT and eSNI.

The idea was that since we're going to be encrypting half the
handshake starting with a Server-> Client message, we could make
extensions that are protected entirely against a passive adversary by
making them 'Server Offers, Client Accepts'.  Some of the extensions
we have could work that way, some could not.

-tom