Subject: [quicwg/base-drafts] Text on session resumption (#3566)

From: Martin Thomson <[email-masked]>
Date: Tue, 07 Apr 2020 17:57:52 -0700

In looking at #3028, I realized that we had nowhere that addressed the basic concept of resumption.  This is, I hope, all that we need to say on the subject.  It talks about state and then the privacy implications of using resumption.

I found less in the TLS 1.3 RFC on this subject than I might have liked to see.  It only really addressed ticket reuse.  So this is a little more verbose than is ideal.

Oh, and there are new requirements here, but as they are restatements of existing requirements, I don&#39;t think that this needs to be a design change.  But I will happily switch to treating this as a design issue if anyone asks.

Closes #3028.
You can view, comment on, or merge this pull request online at:

  https://github.com/quicwg/base-drafts/pull/3566

-- Commit Summary --

  * Text on session resumption

-- File Changes --

    M draft-ietf-quic-tls.md (25)

-- Patch Links --

https://github.com/quicwg/base-drafts/pull/3566.patch
https://github.com/quicwg/base-drafts/pull/3566.diff

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3566

---

From: Christian Huitema <[email-masked]>
Date: Tue, 07 Apr 2020 21:22:28 -0700

@huitema commented on this pull request.

As I said in the text comment, this is good. Only open question is whether there should be a "privacy consideration" note in the security section.

> +that some information be retained; see Section 4.6.1 of {{!TLS13}}. QUIC itself
+does not depend on any state being retained when resuming a connection, unless
+0-RTT is also used; see {{enable-0rtt}} and Section 7.3.1 of
+{{QUIC-TRANSPORT}}. Application protocols could depend on state that is
+retained between resumed connections.
+
+Clients can store any state required for resumption along with the session
+ticket. Servers can use the session ticket to help carry state.
+
+Session resumption allows servers to link activity on the original connection
+with the resumed connection, which might be a privacy issue for clients.
+Clients can choose not to enable resumption to avoid creating this correlation.
+Client SHOULD NOT reuse tickets as that allows entities other than the server
+to correlate connection; see Section C.4 of {{!TLS13}}.
+
+

Looks good. Simple and to the point. My only reservation is about the security section. Session resumption allows tracking by the server, and this is arguably a security issue. The text here properly describes the concern and the remediation, but I wonder whether should there be a mention of these potential privacy issues in the security section.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3566#pullrequestreview-389640637

---

From: Martin Thomson <[email-masked]>
Date: Tue, 07 Apr 2020 23:13:14 -0700

@martinthomson pushed 2 commits.

b51c50467f9d19e5acc1ded87db2cc322b41e57e  Add a note to security considerations
46ee3b6c79fed064878fd43d265c78150a4bf70e  Tweak intro to security considerations

-- 
You are receiving this because you are subscribed to this thread.
View it on GitHub:
https://github.com/quicwg/base-drafts/pull/3566/files/1f12b18593747047824b01fd9b5f05c802615a89..46ee3b6c79fed064878fd43d265c78150a4bf70e

---

From: ianswett <[email-masked]>
Date: Wed, 08 Apr 2020 07:12:10 -0700

@ianswett approved this pull request.

> @@ -648,6 +648,31 @@ messages and clients MUST treat receipt of such messages as a connection error
 of type PROTOCOL_VIOLATION.

+## Session Resumption {#resumption}
+
+QUIC can use the session resumption feature of TLS 1.3. It does this by
+carrying NewSessionTicket messages in CRYPTO frames after the handshake is
+complete. Session resumption is the basis of 0-RTT, but can be used without
+also enabling 0-RTT.
+
+Endpoints that use sesion resumption might need to remember some information

```suggestion
Endpoints that use session resumption might need to remember some information
```

+Endpoints that use sesion resumption might need to remember some information
+about the current connection when creating a resumed connection. TLS requires

```suggestion
Client SHOULD NOT use a single ticket more than once as that allows entities other than the server
```

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3566#pullrequestreview-390012214

---

From: Martin Thomson <[email-masked]>
Date: Wed, 08 Apr 2020 17:38:38 -0700

@martinthomson pushed 1 commit.

4c97d9544a49868c3043177312b3cd97a41d5321  speling

-- 
You are receiving this because you are subscribed to this thread.
View it on GitHub:
https://github.com/quicwg/base-drafts/pull/3566/files/46ee3b6c79fed064878fd43d265c78150a4bf70e..4c97d9544a49868c3043177312b3cd97a41d5321

---

From: Marten Seemann <[email-masked]>
Date: Wed, 08 Apr 2020 22:57:53 -0700

@marten-seemann approved this pull request.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3566#pullrequestreview-390508937

---

From: Mike Bishop <[email-masked]>
Date: Thu, 09 Apr 2020 11:58:45 -0700

@MikeBishop approved this pull request.

> +Endpoints that use session resumption might need to remember some information

```suggestion
to correlate connections; see Section C.4 of {{!TLS13}}.
```

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3566#pullrequestreview-391051991

---

From: Martin Thomson <[email-masked]>
Date: Mon, 13 Apr 2020 17:27:00 -0700

c0ad8f5fa424a23921dbbf33ae76477945b299ce  plural

-- 
You are receiving this because you are subscribed to this thread.
View it on GitHub:
https://github.com/quicwg/base-drafts/pull/3566/files/4c97d9544a49868c3043177312b3cd97a41d5321..c0ad8f5fa424a23921dbbf33ae76477945b299ce

---

From: Martin Thomson <[email-masked]>
Date: Mon, 13 Apr 2020 17:27:09 -0700

@martinthomson commented on this pull request.

TLS uses "reuse", so we can reuse that (sorry).

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3566#discussion_r405892489

---

From: Martin Thomson <[email-masked]>
Date: Tue, 21 Apr 2020 15:23:59 -0700

Merged #3566 into master.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3566#event-3258123619