Subject: Re: [TLS] (draft) WG adoption call: draft-bmoeller-tls-falsestart

From: Hannes Tschofenig <[email-masked]>
Date: Wed, 01 Apr 2015 11:49:11 +0200

I support the publication of this document to capture existing
deployments. Happy to review the doc.

On 03/31/2015 06:20 PM, Sean Turner wrote:
> All,
> 
> There’s been some interested expressed in having
> http://datatracker.ietf.org/doc/draft-bmoeller-tls-falsestart/
> adopted as a TLS WG item.  If you would like for this draft to become
> a WG document, and you are willing to review drafts as it moves
> through the process please indicate as much on this thread.  If you
> are opposed to this being a WG document, please say so (and say why).
> Thanks in advance.
> 
> J&S _______________________________________________ TLS mailing list 
> [email-masked] https://www.ietf.org/mailman/listinfo/tls
>

---

From: Martin Thomson <[email-masked]>
Date: Wed, 1 Apr 2015 10:04:00 -0700

On 31 March 2015 at 19:33, Brian Smith <[email-masked]> wrote:
>
> 4. The references to (FF-)DHE key exchange being acceptable for False
> Start are removed. Although it may be possible to safely implement
> False start for FF-DHE, the current draft isn't a good starting point
> for specifying how that might be done. It's better to remove the
> references until an adequate description of doing False Start for
> FF-DHE key exchange is available, if ever.

I agree with most of what Brian says, particularly with respect to
only accepting the "best" profile of TLS here.  However, I am
generally leery of making specific recommendations regarding cipher
suite choice.  With the explicit groups, this might be OK.  Without
explicit groups, I think that Brian's point is completely valid.

---

From: Brian Smith <[email-masked]>
Date: Wed, 1 Apr 2015 10:16:03 -1000

> explicit groups, I think that Brian's point is completely valid.

Implementing the negotiated FF-DHE mechanism as specified definitely
isn't sufficient and may not be necessary for doing False Start with
FF-DHE cipher suites:

1 The negotiated FF-DHE spec still allows the client to use FF-DHE
parameters that it didn't send, in order to interop with
implementations, as long as it has some "policy" for handling that
case. For False Start, such a policy would have to be defined.

2. As I noted in the Firefox bug, even if the client only does False
Start with parameters it advertised in its FF-DHE extension, there is
still potential for material downgrade if the weakest FF-DHE
parameters it advertises are weaker than the ECDHE curves it supports.

3. Even if the client doesn't implement ECDHE at all, the weakest
FF-DHE key it offers during FF-DHE parameter negotiation may not be
strong enough to do False Start. Given the research I did for Firefox
that showed that any reasonably definition of "strong enough" is
practically equivalent to disabling False Start for FF-DHE, it seems
not to be worthwhile to bother trying to define "strong enough."

Cheers,
Brian

---

From: Bodo Moeller <[email-masked]>
Date: Wed, 1 Apr 2015 16:38:11 -0400

Paul Hoffman <[email-masked]>:

> http://datatracker.ietf.org/doc/draft-bmoeller-tls-falsestart/ adopted as
> a TLS WG item.  If you would like for this draft to become a WG document,
> and you are willing to review drafts as it moves through the process please
> indicate as much on this thread.  If you are opposed to this being a WG
> document, please say so (and say why). Thanks in advance.
>

> If the adopted draft becomes clearer that it is for TLS 1.2 (and possibly
> 1.1) only, but not for 1.3 (since we don't know what that will look like),
> I support its adoption.
>

Right, it makes complete sense to update the document to capture existing
deployment: in particular, explicitly exclude TLS 1.3 from its scope (not
just because we don't know what TLS 1.3 will look like but also because TLS
1.3 can speak for itself), and remove server-side False Start unless we
find any implementations.

(I'm not sure that we have to explicitly *disallow* False Start for
versions below TLS 1.2 as Brian Smith has suggested. After all, servers may
still encounter it with older clients, so that's a part of the reality of
existing deployments. The current *recommendation* could be made stronger,
though.)

Bodo

---

From: Sean Turner <[email-masked]>
Date: Thu, 16 Apr 2015 12:21:01 -0400

Based on list discussion we’re going to go adopt this draft as a WG.

Bodo please submit a WG version of this draft so we can begin addressing Brian’s comments in the WG -01 version.

Thanks everybody!

spt

On Mar 31, 2015, at 12:20, Sean Turner <[email-masked]> wrote:

> All,
> 
> There’s been some interested expressed in having http://datatracker.ietf.org/doc/draft-bmoeller-tls-falsestart/ adopted as a TLS WG item.  If you would like for this draft to become a WG document, and you are willing to review drafts as it moves through the process please indicate as much on this thread.  If you are opposed to this being a WG document, please say so (and say why). Thanks in advance.
> 
> J&S

---

From: Bodo Moeller <[email-masked]>
Date: Sat, 18 Apr 2015 01:21:06 -0400

Thanks, Sean.

Just to confirm, the WG -00 I-D will be essentially identical to the lasted
individual submission, and then we'll work on the changes for -01, right?

I've actually just left for a vacation, so it will be around a week and a
half before I can submit the -00 draft. But then we're not in any kind of
rush for this one.

Bodo

2015-04-16 12:21 GMT-04:00 Sean Turner <[email-masked]>:

> _______________________________________________
> TLS mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/tls
>

---

From: Sean Turner <[email-masked]>
Date: Sat, 18 Apr 2015 10:44:10 -0400

On Apr 18, 2015, at 01:21, Bodo Moeller <[email-masked]> wrote:

> Thanks, Sean.
> 
> Just to confirm, the WG -00 I-D will be essentially identical to the lasted individual submission, and then we'll work on the changes for -01, right?

I think that’s probably the easiest way for folks to track the changes.  You can do one, get it posted and then follow up later in the day with the known changes to keep the ball rolling..

> I've actually just left for a vacation, so it will be around a week and a half before I can submit the -00 draft. But then we're not in any kind of rush for this one.

Thanks for the heads up, I’ll ping you if I don’t hear from you when you get back.  Enjoy your vacation.

spt