Subject: [quicwg/base-drafts] Better articulate principles for ciphersuites (#2743)

From: Martin Thomson <[email-masked]>
Date: Wed, 22 May 2019 02:54:34 -0700

For input to discussion on the related issues.  This says that we don't
do CCM_8 and makes it clear that you don't reject an attempt to use a
ciphersuite you don't understand.

This is an editorial resolution to the design issue.

Closes #2742, #2682, #2581.
You can view, comment on, or merge this pull request online at:

  https://github.com/quicwg/base-drafts/pull/2743

-- Commit Summary --

  * Better articulate principles for ciphersuites

-- File Changes --

    M draft-ietf-quic-tls.md (26)

-- Patch Links --

https://github.com/quicwg/base-drafts/pull/2743.patch
https://github.com/quicwg/base-drafts/pull/2743.diff

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2743

---

From: Nick Harper <[email-masked]>
Date: Wed, 22 May 2019 03:04:51 -0700

nharper commented on this pull request.

> @@ -964,10 +970,12 @@ sample.
 To ensure that sufficient data is available for sampling, packets are padded so
 that the combined lengths of the encoded packet number and protected payload is
 at least 4 bytes longer than the sample required for header protection.  For the
-AEAD functions defined in {{?TLS13}}, which have 16-byte expansions and 16-byte
-header protection samples, this results in needing at least 3 bytes of frames in
-the unprotected payload if the packet number is encoded on a single byte, or 2
-bytes of frames for a 2-byte packet number encoding.
+ciphersuites defined in {{?TLS13}} - other than TLS_AES_128_CCM_8_SHA256, for

Nit: Remove "For" (the sentence should start "The ciphersuites defined in").

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2743#pullrequestreview-240531329

---

From: Rui Paulo <[email-masked]>
Date: Wed, 22 May 2019 03:15:28 -0700

rpaulo commented on this pull request.

> @@ -825,11 +825,17 @@ This provides protection against off-path attackers and robustness against QUIC
 version unaware middleboxes, but not against on-path attackers.
 
 QUIC can use any of the ciphersuites defined in {{!TLS13}} with the exception of
-TLS_AES_128_CCM_8_SHA256.  The AEAD for that ciphersuite, AEAD_AES_128_CCM_8
-{{?CCM=RFC6655}}, does not produce a large enough authentication tag for use
-with the header protection designs provided (see {{header-protect}}).  All other
-ciphersuites defined in {{!TLS13}} have a 16-byte authentication tag and produce
-an output 16 bytes larger than their input.
+TLS_AES_128_CCM_8_SHA256.  A ciphersuite MUST NOT be negotiated unless a header
+protection scheme is defined for the ciphersuite.  This document defines a
+header protection scheme for all ciphersuites defined in {{!TLS13}} aside from
+TLS_AES_128_CCM_8_SHA256.  These ciphersuites have a 16-byte authentication tag
+and produce an output 16 bytes larger than their input.
+
+Note:
+
+: An endpoint MUST NOT reject a ClientHello that offers a ciphersuite that

duplicate "that offers a cipher suite"

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2743#pullrequestreview-240536453

---

From: ekr <[email-masked]>
Date: Wed, 22 May 2019 03:17:10 -0700

LGTM

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2743#issuecomment-494742791

---

From: Kazuho Oku <[email-masked]>
Date: Wed, 22 May 2019 06:08:04 -0700

kazuho approved this pull request.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2743#pullrequestreview-240617110

---

From: Marten Seemann <[email-masked]>
Date: Wed, 22 May 2019 06:11:08 -0700

marten-seemann approved this pull request.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2743#pullrequestreview-240618881

---

From: Martin Thomson <[email-masked]>
Date: Wed, 22 May 2019 07:16:49 -0700

@martinthomson pushed 1 commit.

8fe5ec69b192db580133964a6d5b8225c02bc7f5  Editorial fixes

-- 
You are receiving this because you are subscribed to this thread.
View it on GitHub:
https://github.com/quicwg/base-drafts/pull/2743/files/25104cf2afb468c0579b6298ee2097a68aa0a53b..8fe5ec69b192db580133964a6d5b8225c02bc7f5

---

From: Martin Thomson <[email-masked]>
Date: Wed, 22 May 2019 07:17:02 -0700

Merged #2743 into master.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2743#event-2359488037

---

From: MikkelFJ <[email-masked]>
Date: Wed, 22 May 2019 07:24:59 -0700

I think I must be entirely missing the point, but I don't understand this:

> An endpoint MUST NOT reject a ClientHello that offers a ciphersuite that ...

Can you please explain how this works? For the sake of argument, TLS_AES_128_CCM_8_SHA256 is not supported, but the peer chooses to use it, and the TLS engine behind it all decides to support it via some configuration that the endpoint is directly aware of.

How does the endpoint now deal with header protection. Is it assumed that this is a TLS black box so it just magically works if the TLS engine has accepted the cipher via some useful API call.

If it is a TLS blackbox API call, how would that work with HW offloading?

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2743#issuecomment-494825756

---

From: MikkelFJ <[email-masked]>
Date: Wed, 22 May 2019 07:26:47 -0700

Now I understand it. Being offered by TLS is not the same as being used by any of the endpoints. Sorry for the noise.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2743#issuecomment-494826469