Subject: Re: [TLS] A flags extension

From: Hubert Kario <[email-masked]>
Date: Mon, 01 Apr 2019 12:40:14 +0200

On Friday, 29 March 2019 10:23:51 CEST Martin Thomson wrote:
> On Thu, Mar 28, 2019, at 14:54, Hubert Kario wrote:
> > what about making sure that the legacy and flags remain in-sync? we will
> > have to send the legacy encoding for many years to come, so only thing it
> > would possibly reduce the size of is ServerHello or EncryptedExtensions
> 
> Those are messages where we have size pressure.

why? in what use case?
-- 
Regards,
Hubert Kario
Senior Quality Engineer, QE BaseOS Security team
Web: www.cz.redhat.com
Red Hat Czech s.r.o., Purkyňova 115, 612 00  Brno, Czech Republic

---

From: "Martin Thomson" <[email-masked]>
Date: Mon, 01 Apr 2019 17:05:41 -0400

> > Those are messages where we have size pressure.

QUIC. We have 3600 bytes to play with in that flight. And Certificate is often more than that.

---

From: Hubert Kario <[email-masked]>
Date: Tue, 02 Apr 2019 13:42:59 +0200

> QUIC. We have 3600 bytes to play with in that flight. And Certificate is

then maybe it's QUIC that should be modified to allow for more than 3600 bytes 
to actually make it deployable?

I mean, seriously, if you you need to be bit-pinching now, what will happen 
when PQC gets deployed?!
-- 
Regards,
Hubert Kario
Senior Quality Engineer, QE BaseOS Security team
Web: www.cz.redhat.com
Red Hat Czech s.r.o., Purkyňova 115, 612 00  Brno, Czech Republic

---

From: Christian Huitema <[email-masked]>
Date: Tue, 2 Apr 2019 09:29:18 -0700

> I mean, seriously, if you you need to be bit-pinching now, what will happen 

The problem is "amplification" -- how much data the server is willing to
send without assurance that the client's address is not spoofed. The
current decision is "no more than 3 times the size of the data sent by
the client", which is enforced to be at least 1200 bytes. Quic does work
if the server flight is longer than that, but then the handshake takes
at least 2*RTT instead of 1*RTT.

That said, yes, there is a problem if PQC requires the client hello to
be larger than 1200 bytes.

-- Christian Huitema

---

From: Hubert Kario <[email-masked]>
Date: Wed, 03 Apr 2019 13:03:07 +0200

On Tuesday, 2 April 2019 18:29:18 CEST Christian Huitema wrote:
> > then maybe it's QUIC that should be modified to allow for more than 3600
> > bytes to actually make it deployable?
> > 

so how many connections will end up with a 2RTT instead of 1RTT handshake if 
the server response is not smaller by those 12 bytes or so?

how many connections will actually end up with larger server response because 
they need to send just one flag?
 
> be larger than 1200 bytes.

or the server has certificates with PQC signatures that are few KiB long...

the more PQC is deployed, to more the balance will be skewed towards the 
server, as far as data sent is concerned
-- 
Regards,
Hubert Kario
Senior Quality Engineer, QE BaseOS Security team
Web: www.cz.redhat.com
Red Hat Czech s.r.o., Purkyňova 115, 612 00  Brno, Czech Republic