Subject: [quicwg/base-drafts] Minor nits (#1800)

From: martinduke <[email-masked]>
Date: Tue, 25 Sep 2018 18:54:18 -0700

Added a few explicit statements about how TCP-TLS and QUIC-TLS differ. Synced with the transport draft about which frames are allowed in which contexts.
You can view, comment on, or merge this pull request online at:

  https://github.com/quicwg/base-drafts/pull/1800

-- Commit Summary --

  * Minor nits

-- File Changes --

    M draft-ietf-quic-tls.md (23)

-- Patch Links --

https://github.com/quicwg/base-drafts/pull/1800.patch
https://github.com/quicwg/base-drafts/pull/1800.diff

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/1800

---

From: martinduke <[email-masked]>
Date: Tue, 25 Sep 2018 18:55:10 -0700

@martinduke pushed 1 commit.

27b95f7  typo

-- 
You are receiving this because you are subscribed to this thread.
View it on GitHub:
https://github.com/quicwg/base-drafts/pull/1800/files/c9e297403c30d34ccc3e278d6f0546f416f73543..27b95f7181f42a39a29a0638c942d81556bc33ab

---

From: martinduke <[email-masked]>
Date: Tue, 25 Sep 2018 18:59:34 -0700

090131d  eliminate whitespace

-- 
You are receiving this because you are subscribed to this thread.
View it on GitHub:
https://github.com/quicwg/base-drafts/pull/1800/files/27b95f7181f42a39a29a0638c942d81556bc33ab..090131d1bce5c8bbf2363b23775c4129514c5eb3

---

From: Martin Thomson <[email-masked]>
Date: Wed, 26 Sep 2018 15:46:40 +0000 (UTC)

martinthomson commented on this pull request.

> @@ -387,6 +392,10 @@ peer in CRYPTO frames. When TLS provides handshake octets to be sent, they are
 appended to the current flow and any packet that includes the CRYPTO frame is
 protected using keys from the corresponding encryption level.
 
+Unlike its operations with TCP, the TLS bytestream is never separately
+encrypted and decrypted. This operation only occurs on the QUIC packet as a
+whole.

I know what you are saying, but it's equally confusing because it's not clear what the TLS bytestream is.  For QUIC, it's the sequence of TLS handshake messages, but TLS has other concepts that could be considered to be a bytestream: the sequence of TLS records (unencrypted), or the sequence of protected TLS records could very much be considered to be a bytestream.

Maybe the right thing to say here is that "QUIC takes the unprotected content of TLS handshake records as the content of CRYPTO frames.  Encapsulation of these messages in protected TLS records does not happen.  QUIC assembles CRYPTO frames into QUIC packets, which are protected using QUIC packet protection."

But isn't that written down elsewhere?

> @@ -320,14 +322,17 @@ Each encryption level has a specific list of frames which may appear in it. The
 rules here generalize those of TLS, in that frames associated with establishing
 the connection can usually appear at any encryption level, whereas those
 associated with transferring data can only appear in the 0-RTT and 1-RTT
-encryption levels
+encryption levels.

I think you want a colon:

> @@ -161,6 +161,9 @@ series of typed TLS records. Records are individually cryptographically
 protected and then transmitted over a reliable transport (typically TCP) which
 provides sequencing and guaranteed delivery.
 
+Note that Change Cipher Spec records, optional in TLS over TCP, have no
+encoding for TLS over QUIC.

I would say simply "Change Cipher Spec records cannot be sent in QUIC."

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/1800#pullrequestreview-159063733

---

From: martinduke <[email-masked]>
Date: Wed, 26 Sep 2018 14:17:49 -0700

martinduke commented on this pull request.

I have spent some time looking through the quic-tls draft and cannot find it. That doesn't mean it's not there, but I'll use your language.

I am really looking for a clear statement that says "turn off TLS handshake encryption, dummy".

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/1800#discussion_r220726879

---

From: martinduke <[email-masked]>
Date: Wed, 26 Sep 2018 14:19:36 -0700

ff56015  Addressed MT's issues

-- 
You are receiving this because you are subscribed to this thread.
View it on GitHub:
https://github.com/quicwg/base-drafts/pull/1800/files/090131d1bce5c8bbf2363b23775c4129514c5eb3..ff5601506f8c1837fb61d2e0a8fc9f079125a971

---

From: Martin Thomson <[email-masked]>
Date: Wed, 26 Sep 2018 14:28:42 -0700

@martinthomson pushed 1 commit.

6d34304  Small reword

-- 
You are receiving this because you are subscribed to this thread.
View it on GitHub:
https://github.com/quicwg/base-drafts/pull/1800/files/ff5601506f8c1837fb61d2e0a8fc9f079125a971..6d34304a88f7658684a35db9c3ad5d33dbd1ba2a

---

From: Martin Thomson <[email-masked]>
Date: Wed, 26 Sep 2018 14:29:14 -0700

Thanks, this is a nice improvement (and you are right, that bit about not using TLS record protection really was missing).

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/1800#issuecomment-424876068

---

From: Martin Thomson <[email-masked]>
Date: Wed, 26 Sep 2018 14:29:17 -0700

Merged #1800 into master.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/1800#event-1869567931