From nobody Sun Jun 2 18:29:47 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C56F4120072 for ; Sun, 2 Jun 2019 18:29:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.701 X-Spam-Level: X-Spam-Status: No, score=-2.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=lowentropy.net header.b=xxl1PM1Q; dkim=pass (2048-bit key) header.d=messagingengine.com header.b=14Xf8H/F Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1vEyEd6xkRr4 for ; Sun, 2 Jun 2019 18:29:45 -0700 (PDT) Received: from out1-smtp.messagingengine.com (out1-smtp.messagingengine.com [66.111.4.25]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5337F12004E for ; Sun, 2 Jun 2019 18:29:45 -0700 (PDT) Received: from compute1.internal (compute1.nyi.internal [10.202.2.41]) by mailout.nyi.internal (Postfix) with ESMTP id 8A53B21F92 for ; Sun, 2 Jun 2019 21:29:44 -0400 (EDT) Received: from imap2 ([10.202.2.52]) by compute1.internal (MEProxy); Sun, 02 Jun 2019 21:29:44 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=lowentropy.net; h=mime-version:message-id:date:from:to:subject:content-type; s= fm2; bh=SrFJHNnT3fHUkzI96sqABUnB3ZoSgHrlSqNUtvaCNZo=; b=xxl1PM1Q 2HyckHTXoLRwa96V/3bTEbUcx1mwU99yzww/cF2/rHl+Tn8gJtNcTOY07Qgu0Sdb im4VDf5erysEmTPo7RZZUebqHkhRdUtiTuSwsTSPP5VjToReNhMTbFP6bwhMnOeD CUkWvGJKb89UE4kW0+MIlmCq+O8DC6SVDmuGgwIGhIV+8fZ7ZhsEGRJAH+t9hkjn diFUJXP06o5viZomf5McqlQjsQDISvEENggAvw3eaASIicOVY7Ci7SZ+TOEG1XJL 1A8VL6IDuk/y+idnU6n6dhEq8rEQnKuRKCaeYkotpLyEvoGjR3AF2wwq6jmQMOBq F9n+OkbBEKsdOA== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=content-type:date:from:message-id :mime-version:subject:to:x-me-proxy:x-me-proxy:x-me-sender :x-me-sender:x-sasl-enc; s=fm2; bh=SrFJHNnT3fHUkzI96sqABUnB3ZoSg HrlSqNUtvaCNZo=; b=14Xf8H/FZp0vXUBdB7IKviQg+0JJ8M+wS2Z76yqNCoo1Z OyFTMJAmPDlkyFzOjO+rC8Ur+igXIDlhUtYcj1+hqTQCpB0qDvkGcwSEreoeFsxu MoyQXcV63TLJkaFH3UkvsnHqzBp3TQCjVT/94fiYKu1RYNLw7mvqObByBnGOnMv1 uAT3QmKoXxJQsDIn6yv/a/oRuhxdkrPGKWAhFbZzU7vmYmCmJtOGsjGepFawOrqy SP16z1cnH//smg0vRT8GAjECNK98w/CrS4eNcnrlR/3p0cNpKVpQzwrBrLnZyABQ xuNKR6jNS7EzhVTUcuqAtAVWX1r1dy2jBOuTlpRJg== X-ME-Sender: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgeduuddrudefiedggeeiucetufdoteggodetrfdotf fvucfrrhhofhhilhgvmecuhfgrshhtofgrihhlpdfqfgfvpdfurfetoffkrfgpnffqhgen uceurghilhhouhhtmecufedttdenucenucfjughrpefofgggkfffhffvufgtsehttdertd erredtnecuhfhrohhmpedfofgrrhhtihhnucfvhhhomhhsohhnfdcuoehmtheslhhofigv nhhtrhhophihrdhnvghtqeenucfrrghrrghmpehmrghilhhfrhhomhepmhhtsehlohifvg hnthhrohhphidrnhgvthenucevlhhushhtvghrufhiiigvpedt X-ME-Proxy: Received: by mailuser.nyi.internal (Postfix, from userid 501) id 0BF5DE00A2; Sun, 2 Jun 2019 21:29:44 -0400 (EDT) X-Mailer: MessagingEngine.com Webmail Interface User-Agent: Cyrus-JMAP/3.1.6-555-g49357e1-fmstable-20190528v2 Mime-Version: 1.0 Message-Id: <5887cc7a-1d8f-4b8b-ac29-5df45c920160@www.fastmail.com> Date: Mon, 03 Jun 2019 11:29:47 +1000 From: "Martin Thomson" To: tls@ietf.org Content-Type: text/plain Archived-At: Subject: [TLS] Old signature schemes in CertificateRequest X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 03 Jun 2019 01:29:47 -0000 RSASSA-PKCS1-v1_5 algorithms: Indicates a signature algorithm using RSASSA-PKCS1-v1_5 [RFC8017] with the corresponding hash algorithm as defined in [SHS]. These values refer solely to signatures which appear in certificates (see Section 4.4.2.2) and are not defined for use in signed TLS handshake messages, although they MAY appear in "signature_algorithms" and "signature_algorithms_cert" for backward compatibility with TLS 1.2. Similar things are said about those involving SHA-1 and other "legacy" schemes. My reading is that this permits the inclusion of the related signature schemes in CertificateRequest messages. These can't really be used in CertificateVerify, so there are some interesting corner cases to consider, like the case where only unusable schemes are listed. I don't think that this rises to erratum level, but it's a bit of a problem. Ideally, we'd fix this in a subsequent version by saying some more about CertificateRequest. But then maybe this backward compatibility stuff will no longer be necessary when that time comes (he says optimistically/naively). Is this right? How do you think we should track this problem? From nobody Mon Jun 3 04:52:56 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 77072120092 for ; Mon, 3 Jun 2019 04:52:54 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.901 X-Spam-Level: X-Spam-Status: No, score=-6.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ofvyODSOccb1 for ; Mon, 3 Jun 2019 04:52:52 -0700 (PDT) Received: from mx1.redhat.com (mx1.redhat.com [209.132.183.28]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BD898120004 for ; Mon, 3 Jun 2019 04:52:52 -0700 (PDT) Received: from smtp.corp.redhat.com (int-mx06.intmail.prod.int.phx2.redhat.com [10.5.11.16]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id D0C4E87629; Mon, 3 Jun 2019 11:52:51 +0000 (UTC) Received: from pintsize.usersys.redhat.com (unknown [10.43.21.83]) by smtp.corp.redhat.com (Postfix) with ESMTP id 490D11B465; Mon, 3 Jun 2019 11:52:51 +0000 (UTC) From: Hubert Kario To: tls@ietf.org Date: Mon, 03 Jun 2019 13:52:45 +0200 Message-ID: <2281002.LFakFmYeNM@pintsize.usersys.redhat.com> In-Reply-To: <5887cc7a-1d8f-4b8b-ac29-5df45c920160@www.fastmail.com> References: <5887cc7a-1d8f-4b8b-ac29-5df45c920160@www.fastmail.com> MIME-Version: 1.0 Content-Type: multipart/signed; boundary="nextPart5495687.zfl0cqNMVa"; micalg="pgp-sha512"; protocol="application/pgp-signature" X-Scanned-By: MIMEDefang 2.79 on 10.5.11.16 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.26]); Mon, 03 Jun 2019 11:52:51 +0000 (UTC) Archived-At: Subject: Re: [TLS] Old signature schemes in CertificateRequest X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 03 Jun 2019 11:52:55 -0000 --nextPart5495687.zfl0cqNMVa Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="UTF-8" On Monday, 3 June 2019 03:29:47 CEST Martin Thomson wrote: > RSASSA-PKCS1-v1_5 algorithms: Indicates a signature algorithm using > RSASSA-PKCS1-v1_5 [RFC8017] with the corresponding hash algorithm > as defined in [SHS]. These values refer solely to signatures > which appear in certificates (see Section 4.4.2.2) and are not > defined for use in signed TLS handshake messages, although they > MAY appear in "signature_algorithms" and > "signature_algorithms_cert" for backward compatibility with > TLS 1.2. >=20 > Similar things are said about those involving SHA-1 and other "legacy" > schemes. >=20 > My reading is that this permits the inclusion of the related signature > schemes in CertificateRequest messages. These can't really be used in > CertificateVerify, so there are some interesting corner cases to consider, > like the case where only unusable schemes are listed. or unusable together with unknown - consider PKCS1_v1_5 with ed25519 when t= he=20 client doesn't support ed25519 > I don't think that this rises to erratum level, but it's a bit of a probl= em. > Ideally, we'd fix this in a subsequent version by saying some more about > CertificateRequest. But then maybe this backward compatibility stuff will > no longer be necessary when that time comes (he says > optimistically/naively). yes, ideally the RFC should be more prescriptive about handling of situatio= n=20 when all sigalgs in CR are unusable to the client, but given the RFC overal= l=20 and Alert description explanations, I think sending handshake_failure in su= ch=20 situation is quite uncontroversial. and of course, the client MUST NOT abort the connection upon seeing such=20 legacy values in CR message =2D-=20 Regards, Hubert Kario Senior Quality Engineer, QE BaseOS Security team Web: www.cz.redhat.com Red Hat Czech s.r.o., Purky=C5=88ova 115, 612 00 Brno, Czech Republic --nextPart5495687.zfl0cqNMVa Content-Type: application/pgp-signature; name="signature.asc" Content-Description: This is a digitally signed message part. Content-Transfer-Encoding: 7Bit -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEYeeuxEU+3unL/K+dkqjRuAHS9fUFAlz1Cg0ACgkQkqjRuAHS 9fUmDhAAiTqjYSxpTkMVJblv/i2bn1Vgvk7RLJ7LSeDsA8aiGPx9qc+yURkcAhU8 CFXV1M47mX0OGzNRAkRrgONmwmZc1Wn+SKhMBomILEBd7OtjJrFoqSK3uhnUIsbp t1UsnE3G0p/b5e9dfZ3/k6bMpSYcMEvQNOrzQ1cJR3YeFfvrBtiw8uuH7Yc+FVgP 31DKOu2xW+jroGc4HeNmHr2/UZtcKKXoI011O23p+JnDT9YfOnBOPEb38zNdjK3n 1fJ89HNfZ3LLasWtOLpFEiZW1eR15OaRvgWP8GkKaQaXRVJOm7TruiaeMpbLLOdZ AvOFSbjPblqsvaPyTram9l3YEQl75xs5WStAIyThSMgdVZ/lMiKn8+ueV0a2P9XP p8kn8IVpRy9FxVW+B5epIzQvPm6sD2v4GMI990GdLVk52SGV/onYSGLhyNB4Oyn4 B1IqN/GjAjV97m57PWVYheGXW5do4j3WO0vVtglBAytoDRnkj+Ri2db2AP/x18xB j9orocEQ/P+pGHqCTFma7LC6r3AidkGGIrnENLQl91iqAcZ69qPl5Bhi9Ni7EbgJ WzsYzBUWZ6b//fh33rywQMNGfSW09q7zqNI83bxEHDRUpIdAobNJjAOMf8drTIJn 8yH1H7hgh+VrQ7Xmqqe+prLGq2dwW2DoTaP0Zkngocg6s1QQ3jY= =fkrQ -----END PGP SIGNATURE----- --nextPart5495687.zfl0cqNMVa-- From nobody Wed Jun 5 08:20:40 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7AA441201B3 for ; Wed, 5 Jun 2019 08:20:38 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=heapingbits.net header.b=qFfLNBCA; dkim=pass (2048-bit key) header.d=messagingengine.com header.b=2Qxm7Jt+ Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MZhRQ6z7erUC for ; Wed, 5 Jun 2019 08:20:36 -0700 (PDT) Received: from out3-smtp.messagingengine.com (out3-smtp.messagingengine.com [66.111.4.27]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0325912028B for ; Wed, 5 Jun 2019 08:20:34 -0700 (PDT) Received: from compute6.internal (compute6.nyi.internal [10.202.2.46]) by mailout.nyi.internal (Postfix) with ESMTP id 3AFCD224E7 for ; Wed, 5 Jun 2019 11:20:34 -0400 (EDT) Received: from imap4 ([10.202.2.54]) by compute6.internal (MEProxy); Wed, 05 Jun 2019 11:20:34 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=heapingbits.net; h=mime-version:message-id:in-reply-to:references:date:from:to :subject:content-type; s=fm1; bh=jdzQRHw5f+b3THPpW1wfTqlu8TgZQvY A59c9AI7zrvQ=; b=qFfLNBCA7kDbqGGgHXEMqOW7JbWTc+WdeeOTZiwa2cbfz25 p67qqJug1/WCeZhf1eKQ5+GWGZAZ8JiOE6NyE1vHKCDhoJuysJeOinBnXExloLxR aGl8cp5PhYR64Emlab9fy+Tf4zZ/xfZcLOSA9pXGD5TBAdVUcWLnBKNd/5J4wqsl Jjw8Pbkr47l2vZVKQiBsqKfXfg+QYXxgJSKWK0f0qJBiQnRIF/J34kmQDKJL6dPQ etX8V4c5I4nh2uME6zvARPStWVOZozS5kWuycDq1bdEXYEtBrlmHM9EkmW6Qo58l v0sMQaPTyq43Bj/3tdpLaNTwh599pyfYIwap99g== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to:x-me-proxy :x-me-proxy:x-me-sender:x-me-sender:x-sasl-enc; s=fm2; bh=jdzQRH w5f+b3THPpW1wfTqlu8TgZQvYA59c9AI7zrvQ=; b=2Qxm7Jt+W2xCY2LzzxBrBm KAoVb7QURcy952kxlq2pvLb6eaQUa1UJGUiWW2FsBmuEZLtsnRoG8OdJv4WZk69M pchIXRll2+niHtw9hA5CWHmY5lMWunNiTCgsr0FC1c/LUERhPDy+XLqqcL5HtnJc sHoKnSxN/QHLf+cHbBqyibt5Wk/WKuuihsEhWxiBD8o0TwMoZlJYDAt4Fkz+zSQK itqT0MbjXCp24dYIGBTjLW0xKb1k2Knb/D1JYMbNqmqfqk0AXc02WlnnpA/zWBeR 9zlX+KOsKkKTfg8K1D5/NnCmh4S8RONOT1chctHCHWuW3xaAmqmm1418hUQ9VNfw == X-ME-Sender: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgeduuddrudegvddgkeekucetufdoteggodetrfdotf fvucfrrhhofhhilhgvmecuhfgrshhtofgrihhlpdfqfgfvpdfurfetoffkrfgpnffqhgen uceurghilhhouhhtmecufedttdenucenucfjughrpefofgggkfgjfhffhffvufgtsehttd ertderredtnecuhfhrohhmpedfvehhrhhishhtohhphhgvrhcuhghoohgufdcuoegtrgif sehhvggrphhinhhgsghithhsrdhnvghtqeenucffohhmrghinhepihgvthhfrdhorhhgne curfgrrhgrmhepmhgrihhlfhhrohhmpegtrgifsehhvggrphhinhhgsghithhsrdhnvght necuvehluhhsthgvrhfuihiivgeptd X-ME-Proxy: Received: by mailuser.nyi.internal (Postfix, from userid 501) id B5CDA3C00A0; Wed, 5 Jun 2019 11:20:33 -0400 (EDT) X-Mailer: MessagingEngine.com Webmail Interface User-Agent: Cyrus-JMAP/3.1.6-650-g74f8db0-fmstable-20190604v3 Mime-Version: 1.0 Message-Id: In-Reply-To: <1558344512756.70167@cs.auckland.ac.nz> References: <28511b10-8f6a-4394-95a9-5188130f7b58@www.fastmail.com> <29960808.K0e8lGuAtk@pintsize.usersys.redhat.com> <20190514145249.C6DDB404C@ld9781.wdf.sap.corp> <12276928.OsXPxM6NY9@pintsize.usersys.redhat.com> <20190514205258.5C457404C@ld9781.wdf.sap.corp> <1558344512756.70167@cs.auckland.ac.nz> Date: Wed, 05 Jun 2019 08:20:33 -0700 From: "Christopher Wood" To: "TLS@ietf.org" Content-Type: text/plain Archived-At: Subject: Re: [TLS] WGLC for "Deprecating TLSv1.0 and TLSv1.1" X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 05 Jun 2019 15:20:39 -0000 To close the loop on this, the chairs think this draft should remain solely focused on deprecating legacy TLS versions, not legacy hash functions. Algorithm deprecation may happen elsewhere, be it in draft-lvelvindron-tls-md5-sha1-deprecate or another draft. Best, Chris, Joe, and Sean On Mon, May 20, 2019, at 2:29 AM, Peter Gutmann wrote: > Martin Rex writes: > > >BEAST is an attack against Web Browsers (and the abuse known as SSL-VPNs), it > >is *NO* attack against TLS > > That actually applies to an awful lot of recent attacks on TLS - they're > attacks that rely on web software that's actively cooperating with the > attacker, not attacks on TLS per se. Similar issues affect numerous attacks > on CMS (branded as S/MIME in email) and OpenPGP, they require mail software > that actively cooperates with the attacker. > > For any new attack on a protocol like TLS, you really need a three-stage > summary of what's vulnerable: > > 1. Web-based use of TLS: Pretty much everything. > 2. Non-web-based use of TLS: Very little. > 3. Non-web-based with a few basic mitigations (EMS, EtM): Nothing, or > close to it. > > Peter. > > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls > From nobody Wed Jun 5 09:03:26 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9C4721200B4 for ; Wed, 5 Jun 2019 09:03:18 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=sn3rd.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7yumjSZOqQvi for ; Wed, 5 Jun 2019 09:03:16 -0700 (PDT) Received: from mail-qt1-x832.google.com (mail-qt1-x832.google.com [IPv6:2607:f8b0:4864:20::832]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D62CA1200EB for ; Wed, 5 Jun 2019 09:03:15 -0700 (PDT) Received: by mail-qt1-x832.google.com with SMTP id u12so1243093qth.3 for ; Wed, 05 Jun 2019 09:03:15 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sn3rd.com; s=google; h=from:content-transfer-encoding:mime-version:subject:message-id:date :to; bh=PzYkcmA31UDbYxNXpjN5S0CrG/eJz1mIZnW8KOSzBOo=; b=LzlleJYENctYwBSMHpWHIhP+ygUIClO7aPohzq8gaJWEP1eu8pyATbkCXWY83zAHW/ pAry4aoVwqAkA66eOlcR5hIo6JV90gsdyhdAdAPRHvE4Rbl1AF8ZSnsgZ0pmYa5rdtfU qDgUpz2dup5Lg5h69mdE+W8X4oIJ5mSvZe7sw= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:content-transfer-encoding:mime-version :subject:message-id:date:to; bh=PzYkcmA31UDbYxNXpjN5S0CrG/eJz1mIZnW8KOSzBOo=; b=LOY1pfS2Q1zsU13NOe6ouh2NcSVHSj6lZZT3oFaYLmjeYZjgQzgvDcSNgG6xnRi67+ WOUsaawvRQ5SxdmTR50PrG1yZvOgzyymiDssP/Zf352XgUuIIhc4kaBylr84TRGfc4cc X9O5P4YF1617zvQRVGporj9cfvgdV0YqAnTEP84xN/FrSxis9kCgmasnKGGyiDD9AHxV evkeotuuj+Di9GdeqBE6ejiDmjsW4XIpdGn1CKJuiNXwsGTpZUOgmmjXEGbKMqF/EFIQ UWST8NZ25uBpLCYSsSPauWn4PLsq4Qi5VLWaqkxY6kqW+qn6+gBvlCH8lOsRBawfPn6n 6Shw== X-Gm-Message-State: APjAAAWu2i30vlL2PN4YgLXr76K85Wfy5g1T8J+dNVOjQUxwBg7KgCCP Ys5AuBrVAsK/rLIdg/NUGaWYTznHY7E= X-Google-Smtp-Source: APXvYqwbPGHsgcDy7jXJkrID0NJPBey631u710FTvspyywb7aaGmtbfiBVhddVzYByIJRkXWCzpj6A== X-Received: by 2002:a0c:9151:: with SMTP id q75mr27105363qvq.168.1559750594262; Wed, 05 Jun 2019 09:03:14 -0700 (PDT) Received: from sn3rd.lan ([75.102.131.36]) by smtp.gmail.com with ESMTPSA id j22sm6172749qtp.0.2019.06.05.09.03.12 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 05 Jun 2019 09:03:12 -0700 (PDT) From: Sean Turner Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Message-Id: Date: Wed, 5 Jun 2019 12:03:11 -0400 To: TLS List X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: [TLS] TLS WG presentations X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 05 Jun 2019 16:03:19 -0000 In preparation for the upcoming IETF 105 meeting in Montreal, we=E2=80=99r= e making some changes to the TLS WG presentation requirements and = criteria. A summary of the changes is below. See [1] for more = information. 1. With few exceptions, all non-WG presentations must have an = accompanied I-D submitted before the IETF draft deadline preceding the = meeting. This gives WG members ample time to review the document prior = to the meeting as well as ensuring draft authors acknowledge the Note = Well. 2. Presentation slides and any supporting materials for non-WG drafts = must be sent to the TLS WG chairs (tls-chairs@ietf.org) at least 48 = hours in advance. This gives the chairs an opportunity to review the = presentation and post it for the WG to review before the meeting. = (Chairs post the item at least 24 hours in advance of the meeting.) = Failure to provide the slides in this time frame will result in your = presentation being removed from the agenda. The presentation should not = focus on explaining all technical details. Instead, aim for a high level = overview and reserve details for those items that need additional = elucidation. For example, use of a particular cryptographic primitive = within the context of TLS should be described without explaining the = mathematical details of said primitive. 3. Every presentation should have a one-slide overview of the main = points with links to additional reading resources. Presentations should = be able to cover this slide in a few minutes. In cases where the WG runs = short on time due to critical working group discussions, such slides = provide enough information for interested readers to learn more. Please let us know if you have any questions. Best, Chris, Joe, and Sean [1] https://github.com/tlswg/tlswg-wiki/blob/master/FAQ.md= From nobody Wed Jun 5 14:15:06 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4C0EB12004D for ; Wed, 5 Jun 2019 14:15:04 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=salowey-net.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zpEUkqw5gvXD for ; Wed, 5 Jun 2019 14:15:01 -0700 (PDT) Received: from mail-qk1-x729.google.com (mail-qk1-x729.google.com [IPv6:2607:f8b0:4864:20::729]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B05D51200B5 for ; Wed, 5 Jun 2019 14:15:01 -0700 (PDT) Received: by mail-qk1-x729.google.com with SMTP id c11so152035qkk.8 for ; Wed, 05 Jun 2019 14:15:01 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=salowey-net.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=/T0NyRLkQ0bSWz/YD0M6XQJA2OYx4GWEhPVuOowYV2w=; b=vy5lt0MgExcTZ1ZeaUp8VHe8OTlb1GZSa+MYiKLoX7/S3tZw9HPwvedva6Ox3WqhY+ p1SAk2YrxXjOp5sBvplOPU5f5wRbW/qnO7nPMERYSYrFC7uldaWRFYjpUKuyfdkopfmT 95VC+AJ1coaVAdROwVbq3xuid/BZrG8t95FOLGlu+5/Y9vsjG29UbKFlJwW2gLODFQvX pNWH5NSWOvXIS15l9slN1QAlErfpqbHua1SlLMLq0zcjTldXEKlEjwMiuZvbMEl2PL+g nDwJYtHRFL/1NbPI/LeNSGP+ox/jFYo+RDov5ILwkXK1xhcc2BK/0QYN9qMO/3/mvo8L sh+g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=/T0NyRLkQ0bSWz/YD0M6XQJA2OYx4GWEhPVuOowYV2w=; b=jgZxQuSDGR2AarRAK38o7XWWmnmgx6Rwwzv1XTbkTRlabZDoSlmmCd+AtQyPqFES5l yHg6dtmYC5mS9Fv1K1cuWf1Z+oLwCy4/rj4H8CIx/r1PiheEpvO+eOAYvaiq1/diV1cd csvW+QyCtHf+v+x6th0oYaBIm+VOVL34PlB1YNykUF4Eta+7sXaEo0DjiFTpyFi/g/rN Mnh0Z2d/siKhF6Xxjz3yDIZK8pIaK9WWh2Ffhr84+bwJ9Aug5NSoAS5vBk4nSfphDFcl 5O9mWEnkeZI3vlAHTACaLthpLw6fJ6JupLTgEdr21TPoDmXpqn7qRywaBiONVb3TSB9E Qx/w== X-Gm-Message-State: APjAAAUFN1pYCBaWtjVtODPXuGALbFXzAINgZ5ClAWgrMGz0RliA55YY SmJCUdZHMYMcyw//zMM8A6vGxcn0297+HG4c54xnzEEnzow= X-Google-Smtp-Source: APXvYqyQhaJPZ288Psq2qgKn3ZkkBsfGgn9gA2H2pMtW5DaK3trNvcPZQ09t/GrX5GFwVHOzFHf1Bf4/Bz05VzSKbWA= X-Received: by 2002:a37:e10e:: with SMTP id c14mr16447794qkm.54.1559769300821; Wed, 05 Jun 2019 14:15:00 -0700 (PDT) MIME-Version: 1.0 References: <171CD4CD-BB93-4F96-AD75-97EBA3540A92@vigilsec.com> <25104BB6-CC8A-4575-A308-0B712A855320@vigilsec.com> In-Reply-To: <25104BB6-CC8A-4575-A308-0B712A855320@vigilsec.com> From: Joseph Salowey Date: Wed, 5 Jun 2019 14:14:49 -0700 Message-ID: To: Russ Housley Cc: IETF TLS Content-Type: multipart/alternative; boundary="0000000000001b7ee7058a9a17f6" Archived-At: Subject: Re: [TLS] WGLC for draft-ietf-tls-tls13-cert-with-extern-psk X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 05 Jun 2019 21:15:04 -0000 --0000000000001b7ee7058a9a17f6 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Thanks to everyone that replied to this last call. In summary, there is support to move the draft forward with the minor editorial changes discussed on the list. We=E2=80=99ll start the process of moving this alon= g to the IESG for publication. Thanks, Joe, Sean, and Chris --0000000000001b7ee7058a9a17f6 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Thanks to everyone that replied to this last call.=C2=A0 I= n summary, there is support to move the draft forward with the minor editor= ial changes discussed on the list.=C2=A0 We=E2=80=99ll start the process of= moving this along to the IESG for publication.

Tha= nks,

Joe, Sean, and Chris
--0000000000001b7ee7058a9a17f6-- From nobody Thu Jun 6 09:59:54 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6331D120170 for ; Thu, 6 Jun 2019 09:59:44 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=sn3rd.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vd9vViW_Zg6D for ; Thu, 6 Jun 2019 09:59:42 -0700 (PDT) Received: from mail-qt1-x831.google.com (mail-qt1-x831.google.com [IPv6:2607:f8b0:4864:20::831]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DE920120092 for ; Thu, 6 Jun 2019 09:59:34 -0700 (PDT) Received: by mail-qt1-x831.google.com with SMTP id i34so3485979qta.6 for ; Thu, 06 Jun 2019 09:59:34 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sn3rd.com; s=google; h=from:content-transfer-encoding:mime-version:subject:message-id:date :to; bh=fFwIM44AbUHyFvTtN/9AEY+Ciiw8XN31voYNDGYikMw=; b=MMLLhJ1yM5MmQhkk07EajmtqrRKLW4W+hHVO5LCybpmaUEJkjTllx9iD6nf7AVY3j+ BLGRexroxiwLyIjR9vwSbuDJiLgS8islfVMAfTgPSm4iR3tSFkRogfmVedBIk/3rj95E K8iGqD2h/L6ulDyOn1Q6PK7t61CYs+u5GTo04= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:content-transfer-encoding:mime-version :subject:message-id:date:to; bh=fFwIM44AbUHyFvTtN/9AEY+Ciiw8XN31voYNDGYikMw=; b=VKGKeoKmcFx5D5Hq72J3AMMGhe4p/nqUybeJcZkVN2w7kc8ek6AmsJhNDpCs15aHRN 2+/9sIpxXfXBry/wwRe2XzHs0WARIZMzLMvdU8Ag/5BlDKmF4Hr+ip9tB53dSSQkh43Z JAODsnbfy2Lb/tGNyZOLPIUNnsywwMqCAmCRkn1iayMtgmZL9J9sNocAITVqZqZqEMV1 KlqdQtUQRvX4TuAWFQcJE49L6c/d0pFr6mFqzetCC4SxUromAYZ5cS+e/ktCSeVoWW44 N5v63Bifb8zBhsq4jgqPBsKZAC5xwsJ0+wnThhJjIqlw2rkw9P8b2wIxdcw/iPqB1Y4l jp/g== X-Gm-Message-State: APjAAAU2dt2YA/pQ0Z0bb2XNkKlt9HBYoqye1dODpi4C5vcM9xAI96z4 b3Wu91dNuSPeL/I9rAJTiNroDtteTjI= X-Google-Smtp-Source: APXvYqxPcVGEJ2p5kPsGeL6TAFw0CW5Ga6GiHwuWFiKvTNbzPrJKW1FT1lpoX5wVmZuHjBp85yQ5iw== X-Received: by 2002:a0c:ae31:: with SMTP id y46mr9001654qvc.172.1559840373736; Thu, 06 Jun 2019 09:59:33 -0700 (PDT) Received: from sn3rd.lan ([75.102.131.36]) by smtp.gmail.com with ESMTPSA id s23sm1734310qtj.56.2019.06.06.09.59.32 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 06 Jun 2019 09:59:33 -0700 (PDT) From: Sean Turner Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: quoted-printable Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Message-Id: Date: Thu, 6 Jun 2019 12:59:31 -0400 To: TLS List X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: [TLS] TLS@IETF105: Agenda Topics X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 06 Jun 2019 16:59:45 -0000 The TLS WG will be meeting @ IETF 105 in Montreal. To help the chairs = get a better handle on how much time we will need for our session, = please send in your agenda requests to tls-chairs@ietf.org. Along with = your request please provide an estimate for how much time you will need. Please also review the Guidance for TLS WG presenters that can be found = at [0]. Cheers, Chris, Joe, and Sean [0] https://github.com/tlswg/tlswg-wiki/blob/master/FAQ.md= From nobody Thu Jun 6 16:47:28 2019 Return-Path: X-Original-To: tls@ietf.org Delivered-To: tls@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id EDC7712006E; Thu, 6 Jun 2019 16:47:25 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: Cc: tls@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.97.0 Auto-Submitted: auto-generated Precedence: bulk Reply-To: tls@ietf.org Message-ID: <155986484588.1958.9325131777362231683@ietfa.amsl.com> Date: Thu, 06 Jun 2019 16:47:25 -0700 Archived-At: Subject: [TLS] I-D Action: draft-ietf-tls-ticketrequests-01.txt X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 06 Jun 2019 23:47:26 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Transport Layer Security WG of the IETF. Title : TLS Ticket Requests Authors : Tommy Pauly David Schinazi Christopher A. Wood Filename : draft-ietf-tls-ticketrequests-01.txt Pages : 6 Date : 2019-06-06 Abstract: TLS session tickets enable stateless connection resumption for clients without server-side, per-client state. Servers vend an arbitrary number of session tickets to clients, at their discretion, upon connection establishment. Clients store and use tickets when resuming future connections. This document describes a mechanism by which clients may specify the desired number of tickets needed for future connections. This extension aims to provide a means for servers to determine the number of tickets to generate in order to reduce ticket waste, while simultaneously priming clients for future connection attempts. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-tls-ticketrequests/ There are also htmlized versions available at: https://tools.ietf.org/html/draft-ietf-tls-ticketrequests-01 https://datatracker.ietf.org/doc/html/draft-ietf-tls-ticketrequests-01 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-tls-ticketrequests-01 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Fri Jun 7 01:13:00 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 67A911200F8; Fri, 7 Jun 2019 01:12:59 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wB46V0OnmrKM; Fri, 7 Jun 2019 01:12:57 -0700 (PDT) Received: from mail-lj1-x231.google.com (mail-lj1-x231.google.com [IPv6:2a00:1450:4864:20::231]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8345112004E; Fri, 7 Jun 2019 01:12:57 -0700 (PDT) Received: by mail-lj1-x231.google.com with SMTP id m15so908051ljg.13; Fri, 07 Jun 2019 01:12:57 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:from:date:message-id:subject:to:cc; bh=taKQD9CsAJDSvJjIEmWFbwI0ku8NNdmsTN3VbrRRook=; b=ABmha9ZYsUzLwMNMrQEmWXsaw1Moi1wEXqFUu67GMizfxzAX8FnnJBh+fiKRa4/hB9 0KNlzAkyjhbLyX2MtVWAfCCmCjzVrb1PqKW7NSvEMErohNa35kLuBHxqTMkquwzF3EMB +7qaMnHcL8yBOdDAzHGBEu6v8fwTuRuWssepiMEBfllnaA8e3EIJCwRVFCLMcU4GtiUi ilcppS7ajvpyWCZsi2K91H00zRhO6S7D8yehyHtY4cC0H6MoRRSRxNUSMC3E3kegeJUh eOg7FRxqaid6IMkPMeNFqda8F6fDFAqoXUQJC0I5cbTR9xQr2hW2klm/mapmSRcHDMK7 BjxA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to:cc; bh=taKQD9CsAJDSvJjIEmWFbwI0ku8NNdmsTN3VbrRRook=; b=Z8tlMNPQGRjoKD132TGgfoJLcdHZeGu3Zu/mUMp9YTT0YTfzf9WK/BeQNniR9BHw8Z CuUSZcdBW2erYjdgFiV04TWnGXdyqDqCJeqlJrCjB05vTo+jmNeSgmHYXHDtL9ACP5JA 5jvd+Ovxw9JsILoSew5bPwjCB7KxWK69SV5X3Gl8puLVJhS//DXLeNPH6YWUjc9Yzj74 ASbFYS6UiMcAsmFc4c5d36qUWv9uQHFKTLJpvvu1lRvicl9VUsyQ0Vh+XJLMfjYTO/sN NpmOd/hxDtfx6HZ7LcKiU7WWOPONV5EXnDaAZytBpe9u9IvwPi1K172Du0A7X+8YFcZt U9bQ== X-Gm-Message-State: APjAAAUii4OTtMkiHTXlGvDbN4K9qGOcQP3YECAOyObiHPfxxU26kkiJ UnujoFTH73EmZOXYUSRU9lVxGZkpqWcLQ4o5oLm8ZXPFcLg= X-Google-Smtp-Source: APXvYqzrJvUGP4u76buwGxLvSiW34ErUJ5HCQdTE9TRHBlNxQSgR8JLAPpANPR3BlKB5qa5JK7RZcLnLHS+uMAxNeGE= X-Received: by 2002:a2e:91c5:: with SMTP id u5mr16020447ljg.65.1559895175312; Fri, 07 Jun 2019 01:12:55 -0700 (PDT) MIME-Version: 1.0 From: David Schinazi Date: Fri, 7 Jun 2019 10:12:44 +0200 Message-ID: To: tls@ietf.org Cc: tls-chairs@ietf.org, Tommy Pauly , Christopher Wood Content-Type: multipart/alternative; boundary="000000000000cfbc1c058ab76558" Archived-At: Subject: [TLS] Requesting WGLC for draft-ietf-tls-ticketrequests X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 07 Jun 2019 08:12:59 -0000 --000000000000cfbc1c058ab76558 Content-Type: text/plain; charset="UTF-8" Hi folks, We've submitted draft-ietf-tls-ticketrequests-01 (diff ). We believe this version addresses the comments we've received so far, and the authors feel this document is ready to move forward - we'd like to request Working Group Last Call if the chairs find that reasonable. Afterwards we plan on asking for an IANA early code point assignment if the WGLC goes well. Thanks! Tommy, Chris, and David --000000000000cfbc1c058ab76558 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hi folks,

We've su= bmitted=C2=A0draft-ietf-tls-ticketrequests-01=C2=A0(diff). We b= elieve this version addresses the comments we've received so far, and t= he authors feel this document is ready to move forward - we'd like to r= equest Working Group Last Call if the chairs find that reasonable. Afterwar= ds we plan on asking for an IANA early code point assignment if the WGLC go= es well.

Thanks!
Tommy, Chris, and David=
--000000000000cfbc1c058ab76558-- From nobody Fri Jun 7 04:36:56 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4AE581200E3 for ; Fri, 7 Jun 2019 04:36:55 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.9 X-Spam-Level: X-Spam-Status: No, score=-6.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jqbdcAUIh0hq for ; Fri, 7 Jun 2019 04:36:53 -0700 (PDT) Received: from mx1.redhat.com (mx1.redhat.com [209.132.183.28]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3EFE812001A for ; Fri, 7 Jun 2019 04:36:53 -0700 (PDT) Received: from smtp.corp.redhat.com (int-mx07.intmail.prod.int.phx2.redhat.com [10.5.11.22]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 6F37CB2DCE; Fri, 7 Jun 2019 11:36:52 +0000 (UTC) Received: from pintsize.usersys.redhat.com (ovpn-200-52.brq.redhat.com [10.40.200.52]) by smtp.corp.redhat.com (Postfix) with ESMTP id B06ED10AD78D; Fri, 7 Jun 2019 11:36:51 +0000 (UTC) From: Hubert Kario To: tls@ietf.org, David Schinazi Date: Fri, 07 Jun 2019 13:36:43 +0200 Message-ID: <15449143.JsO9XSn2Py@pintsize.usersys.redhat.com> In-Reply-To: <155986484588.1958.9325131777362231683@ietfa.amsl.com> References: <155986484588.1958.9325131777362231683@ietfa.amsl.com> MIME-Version: 1.0 Content-Type: multipart/signed; boundary="nextPart5803428.Pvd60hfl02"; micalg="pgp-sha512"; protocol="application/pgp-signature" X-Scanned-By: MIMEDefang 2.84 on 10.5.11.22 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.26]); Fri, 07 Jun 2019 11:36:52 +0000 (UTC) Archived-At: Subject: Re: [TLS] I-D Action: draft-ietf-tls-ticketrequests-01.txt X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 07 Jun 2019 11:36:55 -0000 --nextPart5803428.Pvd60hfl02 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="UTF-8" On Friday, 7 June 2019 01:47:25 CEST internet-drafts@ietf.org wrote: > There are also htmlized versions available at: > https://tools.ietf.org/html/draft-ietf-tls-ticketrequests-01 > clients without server-side, per-client state. Servers vend an > number of tickets vended per connection. Second, clients do not have > NewSessionTicket messages to vend. This extension is only applicable > such services to vend tickets to clients to use for accelerated > A supporting server MAY vend TicketRequestContents.count > tickets they are willing to vend to clients. Thus, the number of typos: send, sended I think that the use cases should list a situation in which the client does= =20 not expect to perform session resume, so it can inform the server of that b= y=20 sending the value 0. The draft does not state what is the expected behaviour with tickets in=20 relation to post-handshake authentication. The draft does not state if the extension is negotiated once per session or= =20 its values should be reused for resumed sessions. The draft does not state how the extension interacts with Hello Retry Reque= st=20 handshake. Can it be dropped/added/changed in 2nd CH message? What is expec= ted=20 to happen when client does change it? > Servers that support ticket requests MUST NOT echo "ticket_request" > in the EncryptedExtensions. It's not spelled out what the client is expected to do when server does=20 violate this expectation. I'd say it should abort with unsupported_extensio= n. =2D-=20 Regards, Hubert Kario Senior Quality Engineer, QE BaseOS Security team Web: www.cz.redhat.com Red Hat Czech s.r.o., Purky=C5=88ova 115, 612 00 Brno, Czech Republic --nextPart5803428.Pvd60hfl02 Content-Type: application/pgp-signature; name="signature.asc" Content-Description: This is a digitally signed message part. Content-Transfer-Encoding: 7Bit -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEYeeuxEU+3unL/K+dkqjRuAHS9fUFAlz6TEsACgkQkqjRuAHS 9fWLMRAAmMYm3FMIam06SQ7VqJtGcI6zL0VBc1AP3uTZTS3xJcwj7V4uuWq2Z+AC u+1O8nO7QzjvTIxZUKMcUkjEEe/Nx3m6ozMWhdR4un9qBwKhhNPGFLHk/UNJ/Ra4 QVJ1vd7Q8cp1+E7mGqOfpmMf3qVNN9I4DlISSeU/8ONHTBRpusGgcrmwbrIN7WCp rq+1pbW7VqqXC5Eglv+AWCcKYXLwcCaWedgznu4rTPGs5moEJwT0RsLZriqh4uLc N4Pj3PU2Qbp40gCeV5wLcP//NQ/oJHqO+NjwahTlv9kCxunbH9mrBiJvsYKQ4yGU A4lUFLqzHScYRRuZs7XfoukdU5CWcVIck17eUZ0Bm4nVq3IvoyCkwPYjxJOBnz2D UK6un6wpE6mftvbMDPreZ5KVwnC74FQSpKgwnSqG/ej9xMfQ7VL1Qi0E7uiBBph/ 77SN+UBnz23nDw20z8Ye0Z1+NPLLJ8PoGG/nCBUb8GcY0YI4paeCcUgXtPK2hjuB mCGruYpKtp00ls/bdhHhBZBKIZ7sEUidKhsqNu1PQG52pMCoMBnDi1uN3X3NyOFw n4xVAvQ2MkJyz3uvI3hgxJhfRdKMeyMn28T3qDppglqZQrvnka/EADxnwrJh8534 PolC6VwT9VNSqhGezeTTH+u6W1FdtP22O/CQ+2lLjPbe6+RoAV0= =FY5m -----END PGP SIGNATURE----- --nextPart5803428.Pvd60hfl02-- From nobody Sat Jun 8 06:33:38 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 97E231200B2 for ; Sat, 8 Jun 2019 06:33:37 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.701 X-Spam-Level: X-Spam-Status: No, score=-2.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=heapingbits.net header.b=K3iPqPqI; dkim=pass (2048-bit key) header.d=messagingengine.com header.b=UfJ6oqLQ Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Xb8IXHy1VOyJ for ; Sat, 8 Jun 2019 06:33:35 -0700 (PDT) Received: from wout3-smtp.messagingengine.com (wout3-smtp.messagingengine.com [64.147.123.19]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3A77B120086 for ; Sat, 8 Jun 2019 06:33:35 -0700 (PDT) Received: from compute6.internal (compute6.nyi.internal [10.202.2.46]) by mailout.west.internal (Postfix) with ESMTP id 5AFD93E8; Sat, 8 Jun 2019 09:33:34 -0400 (EDT) Received: from imap4 ([10.202.2.54]) by compute6.internal (MEProxy); Sat, 08 Jun 2019 09:33:34 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=heapingbits.net; h=mime-version:message-id:in-reply-to:references:date:from:to :subject:content-type; s=fm1; bh=n5xocF5A5GPq1MxYDo8w1ADbyvEDoQG mCA/HiRTWuVI=; b=K3iPqPqITBY3pEeurd4JjrBThwXpLgLo14TVahSVW1ufs5/ QbhM6rPiAcXMfHj9Pmt/A9HrYj7tznC6KEgv2fLb2pH5RXxpfCjhPnoUw1TPhWeg 9AQ8/k/7Vyth63Lp9j23KQPnkYNe25NQsSziE5Vqb071w1pR0r+gzCLLShCjFvrv MqTmGqPa2m1jVnZkRek6YAL9iyQV5NdjUbnLqTYM4/ZhkPPTi9G8C2bxXkygQvTT bZS9y7aJahoKc/XuQT6P3T3Ii7UJguBLPODY8iQeKLZ0lp4j+GHwYaYxQ8zmY9YZ AMoAWwN6gopzYkKiZep23w8nME6VB4ApgOXxDsw== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to:x-me-proxy :x-me-proxy:x-me-sender:x-me-sender:x-sasl-enc; s=fm3; bh=n5xocF 5A5GPq1MxYDo8w1ADbyvEDoQGmCA/HiRTWuVI=; b=UfJ6oqLQSxTatjE/lwxNmF prUrKaDSPJxNAwkvPOj62MGSYYexHZJP/g8KHiEmnYqBa75lP7phwsLphQXzBXa1 ALDgMvRHP+7aEO8ZnfUNlSxZBBye7XYhJIYKTwnR2QjhCztiQ6lKm9wqN/UoVao6 ZuI3HdLQdg9WffI1lsUcE9cDnanLs/kG0qpkOEJevzLdhmpiEI/dlqGwmyV58Tq9 JP+LgZWY4AFrt+7e+DWZnaVTYikvwn0S+mhYq9MOxRyHpVqFmD5lZnu55Hb+dHPw PycazripzZZ9n4SQwydhkLOT/solstK9zllGK6g77Rq3wmoSnryMywtGYF+WHyvw == X-ME-Sender: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgeduuddrudegkedgieeiucetufdoteggodetrfdotf fvucfrrhhofhhilhgvmecuhfgrshhtofgrihhlpdfqfgfvpdfurfetoffkrfgpnffqhgen uceurghilhhouhhtmecufedttdenucesvcftvggtihhpihgvnhhtshculddquddttddmne cujfgurhepofgfggfkjghffffhvffutgesthdtredtreertdenucfhrhhomhepfdevhhhr ihhsthhophhhvghrucghohhougdfuceotggrfieshhgvrghpihhnghgsihhtshdrnhgvth eqnecuffhomhgrihhnpehivghtfhdrohhrghenucfrrghrrghmpehmrghilhhfrhhomhep tggrfieshhgvrghpihhnghgsihhtshdrnhgvthenucevlhhushhtvghrufhiiigvpedt X-ME-Proxy: Received: by mailuser.nyi.internal (Postfix, from userid 501) id 0EAB83C00A0; Sat, 8 Jun 2019 09:33:33 -0400 (EDT) X-Mailer: MessagingEngine.com Webmail Interface User-Agent: Cyrus-JMAP/3.1.6-663-gf46ad30-fmstable-20190607v1 Mime-Version: 1.0 Message-Id: In-Reply-To: <15449143.JsO9XSn2Py@pintsize.usersys.redhat.com> References: <155986484588.1958.9325131777362231683@ietfa.amsl.com> <15449143.JsO9XSn2Py@pintsize.usersys.redhat.com> Date: Sat, 08 Jun 2019 06:33:31 -0700 From: "Christopher Wood" To: "Hubert Kario" , "TLS@ietf.org" , "David Schinazi" Content-Type: text/plain Archived-At: Subject: Re: [TLS] I-D Action: draft-ietf-tls-ticketrequests-01.txt X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 08 Jun 2019 13:33:38 -0000 Thanks for the comments, Hubert! Please see inline below. On Fri, Jun 7, 2019, at 4:37 AM, Hubert Kario wrote: > On Friday, 7 June 2019 01:47:25 CEST internet-drafts@ietf.org wrote: > > There are also htmlized versions available at: > > https://tools.ietf.org/html/draft-ietf-tls-ticketrequests-01 > > > clients without server-side, per-client state. Servers vend an > > > number of tickets vended per connection. Second, clients do not have > > > NewSessionTicket messages to vend. This extension is only applicable > > > such services to vend tickets to clients to use for accelerated > > > A supporting server MAY vend TicketRequestContents.count > > > tickets they are willing to vend to clients. Thus, the number of > > typos: send, sended Good catch -- will fix. > I think that the use cases should list a situation in which the client does > not expect to perform session resume, so it can inform the server of that by > sending the value 0. Good suggestion! We can certainly add this. > The draft does not state what is the expected behaviour with tickets in > relation to post-handshake authentication. As the extension is merely a hint to servers when deciding how many tickets to vend, I think this is out of scope for the document. > The draft does not state if the extension is negotiated once per session or > its values should be reused for resumed sessions. It's intended to be once per session, and we'll add that. > The draft does not state how the extension interacts with Hello Retry Request > handshake. Can it be dropped/added/changed in 2nd CH message? What is expected > to happen when client does change it? Also a good catch. Like other extensions that are not affected by the possibly updated ClientHello, it must not change. We need to specify the server side behavior, too. > > Servers that support ticket requests MUST NOT echo "ticket_request" > > in the EncryptedExtensions. > > It's not spelled out what the client is expected to do when server does > violate this expectation. I'd say it should abort with unsupported_extension. That seems reasonable to me. Thanks again for the comments. We'll incorporate them into a next revision ASAP. Best, Chris (no hat) From nobody Fri Jun 14 07:00:52 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 062A4120072 for ; Fri, 14 Jun 2019 07:00:50 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.299 X-Spam-Level: X-Spam-Status: No, score=-4.299 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id tRexbsL11eqZ for ; Fri, 14 Jun 2019 07:00:47 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E783C12002F for ; Fri, 14 Jun 2019 07:00:46 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id CD0FDBE3E for ; Fri, 14 Jun 2019 15:00:44 +0100 (IST) X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YrcVh5MrX8gS for ; Fri, 14 Jun 2019 15:00:43 +0100 (IST) Received: from [10.244.2.138] (95-45-153-252-dynamic.agg2.phb.bdt-fng.eircom.net [95.45.153.252]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id 02B61BE2F for ; Fri, 14 Jun 2019 15:00:42 +0100 (IST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1560520843; bh=BPI37GyTkkhCQS45No5PWRUmeKJmcJGZWdeFrXoYz+g=; h=To:From:Subject:Date:From; b=v0uNP+12C5deRiGFHHdmOuYahrV+bVYDdZTQjQiWaGDW0gRAy1fIv0eyrMCOgk3SK U59rTfBOJMB0jjiJJkd0mgZkWlhnS/CpOYLqeVHc4y28n444r8TIZ9Zhl70BOzdf93 9B17qOMK6wiliFA4WnkiKZwuKZ1VETc+7SyvXAzk= To: "tls@ietf.org" From: Stephen Farrell Openpgp: id=5BB5A6EA5765D2C5863CAE275AB2FAF17B172BEA; url= Autocrypt: addr=stephen.farrell@cs.tcd.ie; prefer-encrypt=mutual; keydata= mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nemCP5PMvmh 5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kTq0IqYzsEv5HI58S+ QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtEgvw4fVhVWJuyy3w//0F2tzKr EMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy+pAh4EKzS1FE7BOZp9daMu9MUQmDqtZU bUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqO Vz+7L+WiVfxLbeVqBwV+4uL9to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJg b097ZaNyuY1ETghVB5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k 4LyM2lp5FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9tlyWxn5Xi HzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQABtDJTdGVwaGVuIEZh cnJlbGwgKDIwMTcpIDxzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPokCQAQTAQgAKgIbAwUJ CZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAUCWj6jdwIZAQAKCRBasvrxexcr6o7QD/9m x9DPJetmW794RXmNTrbTJ44zc/tJbcLdRBh0KBn9OW/EaAqjDmgNJeCMyJTKr1ywaps8HGUN hLEVkc14NUpgi4/Zkrbi3DmTp25OHj6wXBS5qVMyVynTMEIjOfeFFyxG+48od+Xn7qg6LT7G rHeNf+z/r0v9+8eZ1Ip63kshQDGhhpmRMKu4Ws9ZvTW2ACXkkTFaSGYJj3yIP4R6IgwBYGMz DXFX6nS4LA1s3pcPNxOgrvCyb60AiJZTLcOk/rRrpZtXB1XQc23ZZmrlTkl2HaThL6w3YKdi Ti1NbuMeOxZqtXcUshII45sANm4HuWNTiRh93Bn5bN6ddjgsaXEZBKUBuUaPBl7gQiQJcAlS 3MmGgVS4ZoX8+VaPGpXdQVFyBMRFlOKOC5XJESt7wY0RE2C8PFm+5eywSO/P1fkl9whkMgml 3OEuIQiP2ehRt/HVLMHkoM9CPQ7t6UwdrXrvX+vBZykav8x9U9M6KTgfsXytxUl6Vx5lPMLi 2/Jrsz6Mzh/IVZa3xjhq1OLFSI/tT2ji4FkJDQbO+yYUDhcuqfakDmtWLMxecZsY6O58A/95 8Qni6Xeq+Nh7zJ7wNcQOMoDGj+24di2TX1cKLzdDMWFaWzlNP5dB5VMwS9Wqj1Z6TzKjGjru q8soqohwb2CK9B3wzFg0Bs1iBI+2RuFnxLkCDQRaPVAyARAA+g3R0HzGr/Dl34Y07XqGqzq5 SU0nXIu9u8Ynsxj7gR5qb3HgUWYEWrHW2jHOByXnvkffucf5yzwrsvw8Q8iI8CFHiTYHPpey 4yPVn6R0w/FOMcY70eTIu/k6EEFDlDbs09DtKcrsT9bmN0XoRxITlXwWTufYqUnmS+YkAuk+ TLCtUin7OdaS2uU6Ata3PLQSeM2ZsUQMmYmHPwB9rmf+q2I005AJ9Q1SPQ2KNg/8xOGxo13S VuaSqYRQdpV93RuCOzg4vuXtR+gP0KQrus/P2ZCEPvU9cXF/2MIhXgOz207lv3iE2zGyNXld /n8spvWk+0bH5Zqd9Wcba/rGcBhmX9NKKDARZqjkv/zVEP1X97w1HsNYeUFNcg2lk9zQKb4v l1jx/Uz8ukzH2QNhU4R39dbF/4AwWuSVkGW6bTxHJqGs6YimbfdQqxTzmqFwz3JP0OtXX5q/ 6D4pHwcmJwEiDNzsBLl6skPSQ0Xyq3pua/qAP8MVm+YxCxJQITqZ8qjDLzoe7s9X6FLLC/DA L9kxl5saVSfDbuI3usH/emdtn0NA9/M7nfgih92zD92sl1yQXHT6BDa8xW1j+RU4P+E0wyd7 zgB2UeYgrp2IIcfG+xX2uFG5MJQ/nYfBoiALb0+dQHNHDtFnNGY3Oe8z1M9c5aDG3/s29QbJ +w7hEKKo9YMAEQEAAYkCJQQYAQgADwUCWj1QMgIbDAUJCZQmAAAKCRBasvrxexcr6qwvD/9b Rek3kfN8Q+jGrKl8qwY8HC5s4mhdDJZI/JP2FImf5J2+d5/e8UJ4fcsT79E0/FqX3Z9wZr6h sofPqLh1/YzDsYkZDHTYSGrlWGP/I5kXwUmFnBZHzM3WGrL3S7ZmCYMdudhykxXXjq7M6Do1 oxM8JofrXGtwBTLv5wfvvygJouVCVe87Ge7mCeY5vey1eUi4zSSF1zPpR6gg64w2g4TXM5qt SwkZVOv1g475LsGlYWRuJV8TA67yp1zJI7HkNqCo8KyHX0DPOh9c+Sd9ZX4aqKfqH9HIpnCL AYEgj7vofeix7gM3kQQmwynqq32bQGQBrKJEYp2vfeO30VsVx4dzuuiC5lyjUccVmw5D72J0 FlGrfEm0kw6D1qwyBg0SAMqamKN6XDdjhNAtXIaoA2UMZK/vZGGUKbqTgDdk0fnzOyb2zvXK CiPFKqIPAqKaDHg0JHdGI3KpQdRNLLzgx083EqEc6IAwWA6jSz+6lZDV6XDgF0lYqAYIkg3+ 6OUXUv6plMlwSHquiOc/MQXHfgUP5//Ra5JuiuyCj954FD+MBKIj8eWROfnzyEnBplVHGSDI ZLzL3pvV14dcsoajdeIH45i8DxnVm64BvEFHtLNlnliMrLOrk4shfmWyUqNlzilXN2BTFVFH 4MrnagFdcFnWYp1JPh96ZKjiqBwMv/H0kw== Message-ID: Date: Fri, 14 Jun 2019 15:00:42 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.7.0 MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="THjHp87LRmDSTXVpVHxvZCzdWnFAbn0Gn" Archived-At: Subject: [TLS] ESNI test server X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 14 Jun 2019 14:00:50 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --THjHp87LRmDSTXVpVHxvZCzdWnFAbn0Gn Content-Type: multipart/mixed; boundary="anm3HHXotR8NAbdgoUtEEfqTVwIlPYpZ1"; protected-headers="v1" From: Stephen Farrell To: "tls@ietf.org" Message-ID: Subject: ESNI test server --anm3HHXotR8NAbdgoUtEEfqTVwIlPYpZ1 Content-Type: multipart/mixed; boundary="------------AB9DAA25BEEF8CAEAD10BBCD" Content-Language: en-GB This is a multi-part message in MIME format. --------------AB9DAA25BEEF8CAEAD10BBCD Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hiya, I've put up an ESNI-enabled test server (details at [1]) that supports ESNI draft-02 and draft-03 based on my openssl fork. [2] It's a bit of a case of chewing gum and string (the "server" is actually just "openssl s_server" really:-) so don't be surprised if it falls over but it seems to work with FF (draft-02) and with openssl s_client (both versions). I might also bring it up and down myself sometimes as I muck about with the back-end stuff more. Please do ping me if you see any issues with it. I plan to be at the IETF105 hackathon if anyone wanted to play with/against it then. Cheers, S. [1] https://defo.ie/ [2] https://github.com/sftcd/openssl/tree/master/esnistuff --------------AB9DAA25BEEF8CAEAD10BBCD Content-Type: application/pgp-keys; name="0x5AB2FAF17B172BEA.asc" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="0x5AB2FAF17B172BEA.asc" -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nem CP5PMvmh5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kT q0IqYzsEv5HI58S+QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtE gvw4fVhVWJuyy3w//0F2tzKrEMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy +pAh4EKzS1FE7BOZp9daMu9MUQmDqtZUbUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5 iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqOVz+7L+WiVfxLbeVqBwV+4uL9 to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJgb097ZaNyuY1ETghV B5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k4LyM2lp5 FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9t lyWxn5XiHzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQAB tCFTdGVwaGVuIEZhcnJlbGwgPHN0ZXBoZW5AamVsbC5pZT6JAj0EEwEIACcFAlo9 UYwCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQWrL68XsXK+qG CxAApYHWYgGOIL3G6/OpkejdAkQoCVQAK8LJUSf6vzwost4iVfxIKcKW/3RqKNKk rRl8beJ7j1CWXAz9+VXAOsE9+zNxXIDgGA7HlvJnhffl+qwibVgiHgUcJFhCSbBr sjC+1uULaTU8zYEyET//GOGPLF+X+degkE/sesh4zcEAjF7fGPnlncdCCH3tvPZZ sdTcjwOCRVonKsDgQzBTCMz/RPBfEFX44HZx4g1UQAcCA4xlucY8QkJEyCrSNGpG nvGK8DcGSmnstl1/a9fnlhpdFxieX3oY2phJ1WKkYTn6Advrek3UP71CKxpgtPmk d3iUUz/VZa0Cv6YxQXskspRDVEvdCMYSQBtJPQ4y2+5UxVR9GIQXenwYp9AP2niv Voh+ITsDWWeWnnvYMq07rSDjq0nGdj41MJkNX+Yb2PXVyXItcj5ybE3T2+y3pSBG FEZYJGuaL4NwtBJFMOdOtBmUOPbetS2971EL3Izxb7ibOZWDwexv+8R6SWYfP1wV N3p46RyBQuXqJV8ccE11m6vtZTGSYgnLUUFZMRQYH+0hwuYe0T3AA18xDdSYsa8v ovCCd3l5S4UNzIM2PMChqGrEzKapUpZg7+8ACcxRU3b9Ihd7WYjJ+pQPCoWYKozv tEvenbNpE/govO/ED3B14e+R2yevRPjRrsN7PJzSf15fQLuJARwEEAEIAAYFAlo9 UqAACgkQLzyHNoBfjaLrSwf+MIHbFRQ4O5cmLYR5sIByWelN3SuRN/gW8rpKo9Ok Cz6An8uV/iCXy5tNMLzzi0BFl8f22DwBcC5qy9qnlIAdogWam1qWoTAoAD8veEqm uKhYrqJsCcAyNrKYmK0hP3rpHxx1LySDmKYXmw/8qtBXKHTouMm+5tSsznhykRMT AAr2p7PSaHgo+hIVaW/rKSspHjDhhZS+G9mtOZad1IH29M6G1Q1NCO0Ywe8krKLQ IAQlFxtgvOqpPOZNzeKBa/+KbE8TGgMWrkOhC8OeEM5PVzdDhlhD9kPzB/pCKDF5 DofJ/ZRqnDpbKPQ0bsW38AOig3kOc0A27awiBEw3urqR1YkCMwQQAQgAHRYhBH4X CgRchM9GDit5oBDvedn9g1MSBQJbtyScAAoJEBDvedn9g1MSI/oP/0A9J9nrnBMq Zpm857lfYWw+rshLK+tyeP4OQeOqnDFvs9jePpcyJLG3DF2r6VbVKPQq+AE6Uf5h cJBDEN6BjEhRPSbLcqG3A1cz/nNwm8rPmNp+oKhmaBBQGxwciMLmzgynsDydnjPp MyEs04zvsbsl4vrp2095o105l8KcrrxQrioFjbwveGwHQK9bxJKhx9D+gIk+MouB ur45UDKTZkMZrr9FGrtkyXCGAxvKdcNC5Oa8z9sj1rcUJfG/OpVAMWhArdlZbFUQ yoX6pU2Zb1CR2qpWAVerGSfBhmfCyStjARqaKxlftjO+Bj3Jj73Cr5eqej3qB5+V 4BCsPjr4RLvVbYUCPsRdxWc+nBLlfVYkRURu21g1hFm5KFPjgUkyo1s4vjUOY8Dy I+xLGF7f/IhUBG6l+Vswhpwu7ydalZkeFiPx5xna5NfbEYxvsIf71DvipGvIOaHv X4egWoFgm8n/9c3rcMxJtpwHPSsUt5dgLsyu6VE0IbvOAc3dN7CWJ355DVFJq9Zg 2YVf0izSpyyzJeGsgkfjW6xpmdvZxuT2UcN4BTcm6vYqueASGrb3lfhzC5gpeVsc /MoSjTS65vNWbpzONZWMZuLEFraxWJzC0JrDK3NCd0VN3kstqGkVbUIiYOnUm8Vu 4zoVMLlGWzHLIGoPRG2nRezn1YyNfyb5iQGcBBABCgAGBQJbxcflAAoJEGo7ETk8 pK1gE7QL/ApC5P68W5DrI1787WJVZv1u4t/g39vTr7Xer3UMTVQg10vpa7pmqOGh jIDzDMg3Pe3K3M7fVzfAlUA1qw6ne4RCueVoRKpubeF4AlYbMr0K6hNCPjt5uAxm bBVuejKTc6pru5rv5gKL0nDbr+Snft5xt7juBLSSimw0/41sZnkjCxo9rF/RA/v6 +uWyK171RKmsEYu8fFtw1eqUNt/Xj792TUixE3pxXheNtQtZGk/9P3W83ChhG4Fh 5EQsn0pIh9wZIAbMRLpgRKyW87fWHZC8/YH8h7afarvn9Thl5pFUldCe22mNJj6K LChn2aEHQd+PdY1GBpZEcmNEUPuovwzatM0h64hCzTm41eDqRfihZVBT7TbfXQnv 8rywa42Mk756RGzzEZcQEhwQXZcMQUfxIQQ2VyJo0zG36VdZTQF7TF/4Lz7/3cJ5 6jOIm+dwPXtu+C2wAQuD4USOLt4JWPYpqzDfHYJIND/497P9Z9SuQeahr2ez3DRB g3qsHEjBV7QyU3RlcGhlbiBGYXJyZWxsICgyMDE3KSA8c3RlcGhlbi5mYXJyZWxs QGNzLnRjZC5pZT6JAkAEEwEIACoCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwEC HgECF4AFAlo+o3cCGQEACgkQWrL68XsXK+qO0A//ZsfQzyXrZlu/eEV5jU620yeO M3P7SW3C3UQYdCgZ/TlvxGgKow5oDSXgjMiUyq9csGqbPBxlDYSxFZHNeDVKYIuP 2ZK24tw5k6duTh4+sFwUualTMlcp0zBCIzn3hRcsRvuPKHfl5+6oOi0+xqx3jX/s /69L/fvHmdSKet5LIUAxoYaZkTCruFrPWb01tgAl5JExWkhmCY98iD+EeiIMAWBj Mw1xV+p0uCwNbN6XDzcToK7wsm+tAIiWUy3DpP60a6WbVwdV0HNt2WZq5U5Jdh2k 4S+sN2CnYk4tTW7jHjsWarV3FLISCOObADZuB7ljU4kYfdwZ+WzenXY4LGlxGQSl AblGjwZe4EIkCXAJUtzJhoFUuGaF/PlWjxqV3UFRcgTERZTijguVyREre8GNERNg vDxZvuXssEjvz9X5JfcIZDIJpdzhLiEIj9noUbfx1SzB5KDPQj0O7elMHa1671/r wWcpGr/MfVPTOik4H7F8rcVJelceZTzC4tvya7M+jM4fyFWWt8Y4atTixUiP7U9o 4uBZCQ0GzvsmFA4XLqn2pA5rVizMXnGbGOjufAP/efEJ4ul3qvjYe8ye8DXEDjKA xo/tuHYtk19XCi83QzFhWls5TT+XQeVTMEvVqo9Wek8yoxo67qvLKKqIcG9givQd 8MxYNAbNYgSPtkbhZ8SJARwEEAEIAAYFAlo9UqAACgkQLzyHNoBfjaLzHAgAlWT6 NXEGtw/r1miKNGcopzvzILQ9oB8rKI9U9EL6tOf/y2V5oYee/GyQDb3ZdoPxxYYc Jf+RyiH1nMoqUIZiZJaf3bJXinDZ5+AdfE++UR2NBvqaNyC6u3r24jo1B/sagKbY tWgsYtRqHLD4IWi37MZrVyjBuF7u14Q07+uhjq6mX2O/tHpCYw/Q82tbeTRPyUf1 WQOAfD1kfBpW9PvAva5Iw9FWeXpCXRzwxnCZhYfGfqtuSw6CPBYLdbikqML6FZ7E DuTBb/8um1wK7Y9bgeIQC+CYjhYB5RXa1tDJRab2Js4luCvSR0w/CgHw26293tlv e2Q6UTrmHxP5U22DlokCPQQTAQgAJwUCWj1QMgIbAwUJCZQmAAULCQgHAgYVCAkK CwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6tJpD/4rrILH+meP07vrx8wW5eYuqCiP GYnh/CXxIF8eLrfbe5d4QRgtq+w6UeQPMyzKRIRiCoBXB2oJLBZHyxBPxZlg33dT MrEGn8QWKx2iNuz9rZMXyOSWFetuO01d/aUPd5BnbLbIyK5of8xCQlXM6KH8bc+9 gQ7edR9mfLTdvBf2FR522hg8BRBM1imKc3vO8v39+qIHHRjuiwxBBCAOhHtHRsZX ripS0uFA07dM46Oi/E8osjx6fQt/lH5z/PN+2adxYSrLSAXfr1oD3RxYNhuWgyGF L64/VCQb1YGjf0Z5MBPnWm9jgUoOY5K9eNSS0L83WeJjlF5+Q/WOgB+rb49Prm2D Feo9+S9f2V53Llz1WIspXJg6f+n9lmHE94MfQj1GAHCzI0FeL19lvM+LhD8jJSCb hrC3+yobyy/AUOs5Z3E+njjX1FF/VCVAs6iOa6i+XG+Y1hh3ir2y1kckJ5auT10M SU8GEZu9ayU4M3o3N9yxOjaoP0NuQ4MMLL/n/u4u94AeZaHPNBXn/hVfVRRmpRXt GKvJtFAEppGEYezB+bLKIm6XlpPkhnwYzleLZ7AMEco2C6QM8QPB3g3JpS3sqRhA 5rEP4lL16BmijmF+CHoPE/zwgKZbKpyVDqvIW5IDgvfIC2X4pbZDRvGIUKaGSB4+ ksZgUUnNyvfQr2p7jokCMwQQAQgAHRYhBH4XCgRchM9GDit5oBDvedn9g1MSBQJb tySbAAoJEBDvedn9g1MSeKkQAJm44jt1kwHgQgeDBKdjdvl0AjE0xVEQxriZ6lP/ l//34YT0auFfzsYIrChSpQXAEtobBAr4Ohw1Us+BZe+H5P8vm6LRuPwozC3SjwfX 4Iec8+9ot6tIVg4sbedDSgb/CCFVjsmIGcQ1P73JLJTBJ6mxYCV/gn3QC6bwDOFo 7kD9FDHCjRN8XfhHQ4Q9cYyt06uF31qG/aumgWYC9geCGgAwiHgwxNYb9GoJ0iZj CROwbYvLTcQgsVUW2bTmsVR13UVKDsdl02sRV7qcVYW6R0a3Ra8KudX+nt25H5DR Gd382KZ5W8pydsy/viTvD9z6v0ulChBYxAedIvGIClrhbxlLEPmIg4ImVOLGqsUg Vm32J95WOjEkk4PEZ12xSDBtwhSJqmJNboWlfmw43KdIbY8zNhffIO3N6O7FsdGx mqyHeLoTpqY+ySVUPpbuyW8ujnI/J//+6hdTZ9dQsEJQlWngKuWOQ5ma58MPSN88 zllsqhZAFQjNxqnkSzL6ZQ+v/jvuRRe16B80AeO55DsmbWsMv/YLLD1mSi7+Khy2 EtMBhgojWwrGMvdLN6X3mnzNJEscYyLxM9tSk+iySP2sLthK0BVgpAzBSdaf/ezI z60P+neHDzteNFf8Mn7lmgYk1amvZoJ29s5+n2HwxyRL5dVMyMdyQmntubbctfqr Z0tIiQGcBBABCgAGBQJbxcflAAoJEGo7ETk8pK1gnCYMAJY4FeIYjlIXGghFWzsB 4fYwK1+iaFpU3fSto5qcrqVtVPjXpwqczqBWeXGyQxiB0kan4OVAXydIeaP8EAuF CA7paP3s9STLJBO3KurkwyRkPW5zo0X7xVqaVToRsX2Ul98KVJoHYQD1KdezEtwl vpNwiiBr42AYR751Vm6JBVAbQXuFpB3c8bUV0OkkRxNFtL8/2PieHar58n5dntGk bPlPkztahsFqktgacIgXHX5vaT+7YeeZ1DWLOYjGO0wNhkOSeroCmxwJUikU7joB p823L7r5KfpqWTPpSCzVstQKZUGmmoE1qCswY/Ud5wvp9SccpIILkRXj0rZRtfnE 5MpL3hjmtNzfDd9qIsJtBJlSB2hZwAsVm1l+EWN9hG3tqyA43niUMy2n6q690of3 berSiQ+kvY/aC9Hx8I+bKzOV9/J2VUTqfaPZa4Uy2rVX5Q2p69n/PMj7mEer0rCL 3j9V16J9c+s0BSkXoKdtYdB0TWVhBgUybd9qtYcwHWvhP7QuU3RlcGhlbiBGYXJy ZWxsIDxzdGVwaGVuQHRvbGVyYW50bmV0d29ya3MuY29tPokCPQQTAQgAJwUCWj1R WgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6jsc EADEcB0WQEZn2AkrzDs1RhL0Lp6cZi0BigofkbcGfdhJyMSs19C0dhvncrAFClVI 6/Udw3yFtDyYtOCf2W3M3A1K6/RfEizCLzTsdFIhni9gOJLlUpXViQtgrlstjk7h qVV3Ooz4BlCqS4cG7rfqf4LQQPpTAuFUEV9I28FBUB2irqC+v4gTysIgpMw0bA1y BU9sX5jE/tRkzqnuzZrkwiobDtRFJ9qp+7O2JtcY4EsVtLAsaodJKc5cF8R4OvB1 n66vxxcgg9Eh4JNWZ47xsaCmAGo1Bcb2jIY35OtgAL7gCGLRSMKTtAaPy1/fEgIq hCljJ9x40Fkn/3r2BX21WC9HFSPFTBz2RluLRzxdgxOrkYK8EiHUPoE5b1AEzZKw 2AbeXfr57f5zYsN3IqfbQLUjMYtUN1wK3Pjb+idD972wyXMWt8uOzlI7b9Ocu+nY m2whBfJv9Pmp3QYTmPz+LB9lH65VNVUSxSXVr5iWXO3qx1HtEiGEqkporMQCTh3T 5Ud3PvMSRBFFKNs9WhJ/Lxz+SV30WLwG6dr5mQqlzAhb4Phc/zekZyXRdS/oDKrB LUucS36O//49JeyRi1QvOfxnfmIqRIAf/k3PoYJmTo5E82//r5Qj3YGlRu78ba0H Arxs+ACD6AnEHHcbswpbtVEKYzlSu0Ar0Dc7vRWM/IyQdIkBHAQQAQgABgUCWj1S oAAKCRAvPIc2gF+NosIsB/9f/29FNla3BJfGIEIDnhrqGD0i9bSa89SqBd++uG06 TQgW5wsqtNcrwn81yZTq6XE6i9VtD4GKfqC0d4KZJr9bnbeD81cI64VOdL8zJWJs 0vj5EIXCobKyX74Kb4uePUyZqwT2Q74I116u/HwA9/FXsPo5isbh4ZqD4t0VHpWk mfq1FPT9a/JPyX46qKqB2Fce/7Qy+SQP1NfkuUlbhUH/JG9aSSYvk3lznNiH41x9 M+FDlL106itXOubrl3oi2fT3fsSedq7uzt+IV0DQEeNaoQAUuwEhdB8IWOMqN2wo DjGVKJftfsSWY9ilZrnDBNDrp0vRqcx33LUMkIw4d7iBiQIzBBABCAAdFiEEfhcK BFyEz0YOK3mgEO952f2DUxIFAlu3JJwACgkQEO952f2DUxJjuw/6ApHSsVTWD4a0 H6FJ23A9Ftpy+aXZ4vYlzkSrfsn2ECrEfK3lXQh/uzwjJUDYZeB1/BQsFZtcYNQO JSSHbQ49BFRLwb1J/wBZG4bbmrkLxnNbKDKQvzxEpclkMW0Dj0J6o7kGrmzIGGrh B+JJN99AcineHRug8ZSFIERRCmigxdhAKU0BFD7P+5HNHltSL3DF1c2fFOf2JrgB KVoE+9RhMZjWNbYetFFLCkjXb5Rpay9zeMm1DxfSTGAnuOwUXW6qq4hnl5+VC/48 ceDZElLLfu7RQUZv44pkSTOWZs+iQoJiHMFHk9wPqyB2Vok1yJ2a2j27WhXrJlPw nZbgJO5RyWDG3p/eVmpl5Uuc2dsfIpR17KnAuWpghK6V+cyFncDoGCl/YG2Mvool sW08FiZh3Ej4dnJjj25TZkeFG74JJDXLvMYpJfSBGnmETv4Dhcm2xPqVMuFuL1qJ lMbVLrMo2GXeo03OzNyvbs+u8WLIaGm5hC7N1CXY8wZs4jo6OJ/expvnc07dEuws 4zT3AiWv3nIouWReRStZy9QkavDocqbyPmilcdPCYk4BsOlzpwwO74hNG7iyl0Kd AlwTxGQ7y0rJou6HYa1TmRhIEr3vKvlW+JfUUrqtjXgsuacTXo4+Ira2JUErL2cY zQMq1j4r1ZyhFnuz93s7Rsx/Nw0+0YuJAZwEEAEKAAYFAlvFx+UACgkQajsROTyk rWCJqwv+NLVPE4sD4sDA2/6Ek7UsRIUkg+S39fhqWsLc4rtw/mDunv8Un61I3K04 fZ2Ry4nF9hZM0a710UvXFbStvrzRJO3EAAcdJR9LTCd19e8UeruQbIee3YT91U4N kC9JMpecfq62/teOAU2e5P3fWYaLs5ZX7zCLwWuBcW2l3SyoljQczM85HhJ3XHm+ FnwQ6D9xRle+lvWTcuC9d1yAyUb8IOospcL2lJTmy8e3r79R24hPlSB4LDe0wEN8 AXbagrcAQZjwyaHyWxjJbTwZ0b43WGdfIqZ1ElOeoffbketPGRmWvx5xUvb2ALFB BdETzV270gs5XDJgJ1SIIKOyDADxwvroTe2jD8C/841eEql5QSow3s/U3zRqk3mt tto8Qw/DN71aeh6dmYSsvd2UjsHw/vofOPRBGxZLEkKTEvMnhmMW9hiKPkPia+Qg evYE020qpKSxLEdWA8nprHwxmGiDNesCfXSC6vm1qfyj5g8HzxSckq9ZaMhKMCo7 vxflUEDuuQINBFo9UDIBEAD6DdHQfMav8OXfhjTteoarOrlJTSdci727xiezGPuB HmpvceBRZgRasdbaMc4HJee+R9+5x/nLPCuy/DxDyIjwIUeJNgc+l7LjI9WfpHTD 8U4xxjvR5Mi7+ToQQUOUNuzT0O0pyuxP1uY3RehHEhOVfBZO59ipSeZL5iQC6T5M sK1SKfs51pLa5ToC1rc8tBJ4zZmxRAyZiYc/AH2uZ/6rYjTTkAn1DVI9DYo2D/zE 4bGjXdJW5pKphFB2lX3dG4I7ODi+5e1H6A/QpCu6z8/ZkIQ+9T1xcX/YwiFeA7Pb TuW/eITbMbI1eV3+fyym9aT7Rsflmp31Zxtr+sZwGGZf00ooMBFmqOS//NUQ/Vf3 vDUew1h5QU1yDaWT3NApvi+XWPH9TPy6TMfZA2FThHf11sX/gDBa5JWQZbptPEcm oazpiKZt91CrFPOaoXDPck/Q61dfmr/oPikfByYnASIM3OwEuXqyQ9JDRfKrem5r +oA/wxWb5jELElAhOpnyqMMvOh7uz1foUssL8MAv2TGXmxpVJ8Nu4je6wf96Z22f Q0D38zud+CKH3bMP3ayXXJBcdPoENrzFbWP5FTg/4TTDJ3vOAHZR5iCunYghx8b7 Ffa4UbkwlD+dh8GiIAtvT51Ac0cO0Wc0Zjc57zPUz1zloMbf+zb1Bsn7DuEQoqj1 gwARAQABiQIlBBgBCAAPBQJaPVAyAhsMBQkJlCYAAAoJEFqy+vF7FyvqrC8P/1tF 6TeR83xD6MasqXyrBjwcLmziaF0Mlkj8k/YUiZ/knb53n97xQnh9yxPv0TT8Wpfd n3BmvqGyh8+ouHX9jMOxiRkMdNhIauVYY/8jmRfBSYWcFkfMzdYasvdLtmYJgx25 2HKTFdeOrszoOjWjEzwmh+tca3AFMu/nB++/KAmi5UJV7zsZ7uYJ5jm97LV5SLjN JIXXM+lHqCDrjDaDhNczmq1LCRlU6/WDjvkuwaVhZG4lXxMDrvKnXMkjseQ2oKjw rIdfQM86H1z5J31lfhqop+of0cimcIsBgSCPu+h96LHuAzeRBCbDKeqrfZtAZAGs okRina9947fRWxXHh3O66ILmXKNRxxWbDkPvYnQWUat8SbSTDoPWrDIGDRIAypqY o3pcN2OE0C1chqgDZQxkr+9kYZQpupOAN2TR+fM7JvbO9coKI8Uqog8CopoMeDQk d0YjcqlB1E0svODHTzcSoRzogDBYDqNLP7qVkNXpcOAXSVioBgiSDf7o5RdS/qmU yXBIeq6I5z8xBcd+BQ/n/9Frkm6K7IKP3ngUP4wEoiPx5ZE5+fPIScGmVUcZIMhk vMvem9XXh1yyhqN14gfjmLwPGdWbrgG8QUe0s2WeWIyss6uTiyF+ZbJSo2XOKVc3 YFMVUUfgyudqAV1wWdZinUk+H3pkqOKoHAy/8fST =3DYzQY -----END PGP PUBLIC KEY BLOCK----- --------------AB9DAA25BEEF8CAEAD10BBCD-- --anm3HHXotR8NAbdgoUtEEfqTVwIlPYpZ1-- --THjHp87LRmDSTXVpVHxvZCzdWnFAbn0Gn Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEW7Wm6ldl0sWGPK4nWrL68XsXK+oFAl0DqIoACgkQWrL68XsX K+rmRRAAiEJy7s1fOQ8zz2xmEttUwDPT9gfdtgl0yeiKVoEp1DVTKJa6nzwDNMGQ jx/IwiRJ4PNQxLj8JtaAHcCMxUfH93uie/6PqBVSaE0ZfehPBj6zoVIpIZydoeTz rzIDiVKi/jZPLbIQBr/r6qt/ffimPHsAWc7bJBhTravSpaAJIywD+up68EFQmSRn tUMhGC+l9mLvMh2GxCNet9d6wPhx40N08KG0/JdLjBdCmVumfI1xpCoFIiIIktnR RfUKpeDzj+StplIJS9GvEJFCigj2eSDoN5X7ATdwX5EtyO7i3yc/+S1cBZlZ6VOY VZSnIJIyqSEz6YdhsWaysotj+C8NIMJWhJHNYXM3NUHt5o4s0MJnt06Cjr812oAx nDa08qyy5Qbna+EL3pZ0/rb0uVDrSlvmHAomL5eZjI4f9aFvy2zMOyGYGQyQSmXl Mg08wuyaZ2JuGs4RYIl3Yn6eooNbVz99m0PPSv1N0W1hVWrQv6ffYhpWxlFKunk6 A4iNnACJYj3hC8Klo9GU6gw/iJXyEyd52RngSQe56eeoem+uioVcQfAbH2qsp2ag O6VJHjOK67S7NX+4yJkPXoQhWpDAdeFQN4KEsUVxLwLwVcmmpYIJe0n1VVlULerJ dIIMYnCjRsHs49eZuNl+A4lOE7Ns9E37f+AM0cg66rPki7jflBU= =gCUs -----END PGP SIGNATURE----- --THjHp87LRmDSTXVpVHxvZCzdWnFAbn0Gn-- From nobody Wed Jun 19 15:34:27 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A2B9612049B for ; Wed, 19 Jun 2019 15:34:26 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.3 X-Spam-Level: X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id IjNie3NeSw0y for ; Wed, 19 Jun 2019 15:34:24 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A417F12041D for ; Wed, 19 Jun 2019 15:34:23 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id A282ABE77 for ; Wed, 19 Jun 2019 23:34:19 +0100 (IST) X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id G-fylfmaCHNE for ; Wed, 19 Jun 2019 23:34:17 +0100 (IST) Received: from [10.244.2.138] (95-45-153-252-dynamic.agg2.phb.bdt-fng.eircom.net [95.45.153.252]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id 8FF9BBE73 for ; Wed, 19 Jun 2019 23:34:17 +0100 (IST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1560983657; bh=NmGz55NWowfOf/xolznX6TDBEvfAi40gz2kWvMu2m6U=; h=To:From:Subject:Date:From; b=z8SiOZPT0Zb3CFqNNPxS3F+hKbKEZc3P4orGh0Cjk/+KSSpTkR9uE4BYTdZGFkC+x o2DiT4YJmTrYgs1M+6w2zs38C7OA6MSlfyAnZ7N7YXbPq7BFvPH2SmIVv7T8j2pQFb so3wWgtpTwQz2fn+Y0pfbtndbBDZbvNRpwkjR4v4= To: "tls@ietf.org" From: Stephen Farrell Openpgp: id=5BB5A6EA5765D2C5863CAE275AB2FAF17B172BEA; url= Autocrypt: addr=stephen.farrell@cs.tcd.ie; prefer-encrypt=mutual; keydata= mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nemCP5PMvmh 5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kTq0IqYzsEv5HI58S+ QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtEgvw4fVhVWJuyy3w//0F2tzKr EMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy+pAh4EKzS1FE7BOZp9daMu9MUQmDqtZU bUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqO Vz+7L+WiVfxLbeVqBwV+4uL9to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJg b097ZaNyuY1ETghVB5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k 4LyM2lp5FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9tlyWxn5Xi HzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQABtDJTdGVwaGVuIEZh cnJlbGwgKDIwMTcpIDxzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPokCQAQTAQgAKgIbAwUJ CZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAUCWj6jdwIZAQAKCRBasvrxexcr6o7QD/9m x9DPJetmW794RXmNTrbTJ44zc/tJbcLdRBh0KBn9OW/EaAqjDmgNJeCMyJTKr1ywaps8HGUN hLEVkc14NUpgi4/Zkrbi3DmTp25OHj6wXBS5qVMyVynTMEIjOfeFFyxG+48od+Xn7qg6LT7G rHeNf+z/r0v9+8eZ1Ip63kshQDGhhpmRMKu4Ws9ZvTW2ACXkkTFaSGYJj3yIP4R6IgwBYGMz DXFX6nS4LA1s3pcPNxOgrvCyb60AiJZTLcOk/rRrpZtXB1XQc23ZZmrlTkl2HaThL6w3YKdi Ti1NbuMeOxZqtXcUshII45sANm4HuWNTiRh93Bn5bN6ddjgsaXEZBKUBuUaPBl7gQiQJcAlS 3MmGgVS4ZoX8+VaPGpXdQVFyBMRFlOKOC5XJESt7wY0RE2C8PFm+5eywSO/P1fkl9whkMgml 3OEuIQiP2ehRt/HVLMHkoM9CPQ7t6UwdrXrvX+vBZykav8x9U9M6KTgfsXytxUl6Vx5lPMLi 2/Jrsz6Mzh/IVZa3xjhq1OLFSI/tT2ji4FkJDQbO+yYUDhcuqfakDmtWLMxecZsY6O58A/95 8Qni6Xeq+Nh7zJ7wNcQOMoDGj+24di2TX1cKLzdDMWFaWzlNP5dB5VMwS9Wqj1Z6TzKjGjru q8soqohwb2CK9B3wzFg0Bs1iBI+2RuFnxLkCDQRaPVAyARAA+g3R0HzGr/Dl34Y07XqGqzq5 SU0nXIu9u8Ynsxj7gR5qb3HgUWYEWrHW2jHOByXnvkffucf5yzwrsvw8Q8iI8CFHiTYHPpey 4yPVn6R0w/FOMcY70eTIu/k6EEFDlDbs09DtKcrsT9bmN0XoRxITlXwWTufYqUnmS+YkAuk+ TLCtUin7OdaS2uU6Ata3PLQSeM2ZsUQMmYmHPwB9rmf+q2I005AJ9Q1SPQ2KNg/8xOGxo13S VuaSqYRQdpV93RuCOzg4vuXtR+gP0KQrus/P2ZCEPvU9cXF/2MIhXgOz207lv3iE2zGyNXld /n8spvWk+0bH5Zqd9Wcba/rGcBhmX9NKKDARZqjkv/zVEP1X97w1HsNYeUFNcg2lk9zQKb4v l1jx/Uz8ukzH2QNhU4R39dbF/4AwWuSVkGW6bTxHJqGs6YimbfdQqxTzmqFwz3JP0OtXX5q/ 6D4pHwcmJwEiDNzsBLl6skPSQ0Xyq3pua/qAP8MVm+YxCxJQITqZ8qjDLzoe7s9X6FLLC/DA L9kxl5saVSfDbuI3usH/emdtn0NA9/M7nfgih92zD92sl1yQXHT6BDa8xW1j+RU4P+E0wyd7 zgB2UeYgrp2IIcfG+xX2uFG5MJQ/nYfBoiALb0+dQHNHDtFnNGY3Oe8z1M9c5aDG3/s29QbJ +w7hEKKo9YMAEQEAAYkCJQQYAQgADwUCWj1QMgIbDAUJCZQmAAAKCRBasvrxexcr6qwvD/9b Rek3kfN8Q+jGrKl8qwY8HC5s4mhdDJZI/JP2FImf5J2+d5/e8UJ4fcsT79E0/FqX3Z9wZr6h sofPqLh1/YzDsYkZDHTYSGrlWGP/I5kXwUmFnBZHzM3WGrL3S7ZmCYMdudhykxXXjq7M6Do1 oxM8JofrXGtwBTLv5wfvvygJouVCVe87Ge7mCeY5vey1eUi4zSSF1zPpR6gg64w2g4TXM5qt SwkZVOv1g475LsGlYWRuJV8TA67yp1zJI7HkNqCo8KyHX0DPOh9c+Sd9ZX4aqKfqH9HIpnCL AYEgj7vofeix7gM3kQQmwynqq32bQGQBrKJEYp2vfeO30VsVx4dzuuiC5lyjUccVmw5D72J0 FlGrfEm0kw6D1qwyBg0SAMqamKN6XDdjhNAtXIaoA2UMZK/vZGGUKbqTgDdk0fnzOyb2zvXK CiPFKqIPAqKaDHg0JHdGI3KpQdRNLLzgx083EqEc6IAwWA6jSz+6lZDV6XDgF0lYqAYIkg3+ 6OUXUv6plMlwSHquiOc/MQXHfgUP5//Ra5JuiuyCj954FD+MBKIj8eWROfnzyEnBplVHGSDI ZLzL3pvV14dcsoajdeIH45i8DxnVm64BvEFHtLNlnliMrLOrk4shfmWyUqNlzilXN2BTFVFH 4MrnagFdcFnWYp1JPh96ZKjiqBwMv/H0kw== Message-ID: Date: Wed, 19 Jun 2019 23:34:16 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.7.0 MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="ELxBh7O3fTSMImVUiRPRSLubS44pjL1T9" Archived-At: Subject: [TLS] ESNI and padding X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 19 Jun 2019 22:34:27 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --ELxBh7O3fTSMImVUiRPRSLubS44pjL1T9 Content-Type: multipart/mixed; boundary="nPl5nibXbsKR3uNV15iL8LqDnKQWG2rre"; protected-headers="v1" From: Stephen Farrell To: "tls@ietf.org" Message-ID: Subject: ESNI and padding --nPl5nibXbsKR3uNV15iL8LqDnKQWG2rre Content-Type: multipart/mixed; boundary="------------FFC0F366F0339DCF01681200" Content-Language: en-GB This is a multi-part message in MIME format. --------------FFC0F366F0339DCF01681200 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hiya, TL;DR: I think we ought remove the ESNIKeys.padded_length field, define a purely algorithmic padding scheme with no configuration needed and RECOMMEND that people using ESNI don't use names that are exceptionally long. In the web, ESNI is hides the web site to which a browser is connecting but there are a few ways in which the lengths of handshake fields could give the game away. So the current draft provides mechanisms to avoid those issues in the handshake. But I think we can do better with less. (As a side-note - the ESNI spec is not trying, and shouldn't try, to define how to pad TLS application traffic. While that is something that will need to be figured out, it's out of scope for ESNI, which rightly only deals with the handshake IMO.) My main problem with the current approach is that a server might not (easily) know the longest name or certificate that they will serve for the duration for which one ESNIKeys value is current. I've come across openssl related code and mails that indicate that server code accesses the server cert and private key via a DB lookup. That DB might not be readily searchable for whomever generates the ESNIKeys. The current draft calls for fixing the padded_length in the ESNIKeys structure published in the DNS to cover the longest needed. It could easily be problematic to ensure those don't get out of whack, leading to avoidable error cases. The current approach also links the cadence with which one updates the DNS with how often new TLS server certificates appear, which seems like an undesirable and unnecessary linkage. And of course, while the length of the server name is under local control, the length of certificates is not. Separately, I think the current approach will lead to deployments over-estimating the padding needed "just in case", e.g. CF's deployment calls for padding to 260 octets (and I've copied that in mine so far:-) I would assume CF picked that number for that not-great "just in case" reason but don't know. In any case, 260 seems wasteful to me and if it ended up widespread could cause an issue later if the ClientHello gets bigger for other reasons, and/or if someone started to depend on it for some weird reason. What I'd suggest instead: - delete the padded_length field from ESNIKeys, so nobody needs to configure anything for padding - clients MUST pad to a multiple of N octets where N is in the spec (I'd suggest N=3D32, but any number that's longer than nearly all real TLS server names would be good) - we RECOMMEND clients randomly add an additional N octets of padding with probability X%, perhaps with X=3D10 (btw - am I right in thinking that if X% is greater than the percentage of real names that are longer than N, then we're good?) - we STRONGLY RECOMMEND that servers choose names shorter than N octets for hidden web sites - servers pad Certificate to a multiple of M octets (M=3D2000 maybe) and CertificateVerify to a multiple of O octets (with O=3D500 maybe) I'd be fine with any minor changes to the above as well or with another scheme that allows us to get rid of the ESNIKeys.padded_length field. Cheers, S. PS: There was a little discussion of this on github, [1] but I figure this is really one the WG ought deal with. [1] https://github.com/tlswg/draft-ietf-tls-esni/pull/122 --------------FFC0F366F0339DCF01681200 Content-Type: application/pgp-keys; name="0x5AB2FAF17B172BEA.asc" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="0x5AB2FAF17B172BEA.asc" -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nem CP5PMvmh5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kT q0IqYzsEv5HI58S+QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtE gvw4fVhVWJuyy3w//0F2tzKrEMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy +pAh4EKzS1FE7BOZp9daMu9MUQmDqtZUbUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5 iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqOVz+7L+WiVfxLbeVqBwV+4uL9 to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJgb097ZaNyuY1ETghV B5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k4LyM2lp5 FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9t lyWxn5XiHzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQAB tCFTdGVwaGVuIEZhcnJlbGwgPHN0ZXBoZW5AamVsbC5pZT6JAj0EEwEIACcFAlo9 UYwCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQWrL68XsXK+qG CxAApYHWYgGOIL3G6/OpkejdAkQoCVQAK8LJUSf6vzwost4iVfxIKcKW/3RqKNKk rRl8beJ7j1CWXAz9+VXAOsE9+zNxXIDgGA7HlvJnhffl+qwibVgiHgUcJFhCSbBr sjC+1uULaTU8zYEyET//GOGPLF+X+degkE/sesh4zcEAjF7fGPnlncdCCH3tvPZZ sdTcjwOCRVonKsDgQzBTCMz/RPBfEFX44HZx4g1UQAcCA4xlucY8QkJEyCrSNGpG nvGK8DcGSmnstl1/a9fnlhpdFxieX3oY2phJ1WKkYTn6Advrek3UP71CKxpgtPmk d3iUUz/VZa0Cv6YxQXskspRDVEvdCMYSQBtJPQ4y2+5UxVR9GIQXenwYp9AP2niv Voh+ITsDWWeWnnvYMq07rSDjq0nGdj41MJkNX+Yb2PXVyXItcj5ybE3T2+y3pSBG FEZYJGuaL4NwtBJFMOdOtBmUOPbetS2971EL3Izxb7ibOZWDwexv+8R6SWYfP1wV N3p46RyBQuXqJV8ccE11m6vtZTGSYgnLUUFZMRQYH+0hwuYe0T3AA18xDdSYsa8v ovCCd3l5S4UNzIM2PMChqGrEzKapUpZg7+8ACcxRU3b9Ihd7WYjJ+pQPCoWYKozv tEvenbNpE/govO/ED3B14e+R2yevRPjRrsN7PJzSf15fQLuJARwEEAEIAAYFAlo9 UqAACgkQLzyHNoBfjaLrSwf+MIHbFRQ4O5cmLYR5sIByWelN3SuRN/gW8rpKo9Ok Cz6An8uV/iCXy5tNMLzzi0BFl8f22DwBcC5qy9qnlIAdogWam1qWoTAoAD8veEqm uKhYrqJsCcAyNrKYmK0hP3rpHxx1LySDmKYXmw/8qtBXKHTouMm+5tSsznhykRMT AAr2p7PSaHgo+hIVaW/rKSspHjDhhZS+G9mtOZad1IH29M6G1Q1NCO0Ywe8krKLQ IAQlFxtgvOqpPOZNzeKBa/+KbE8TGgMWrkOhC8OeEM5PVzdDhlhD9kPzB/pCKDF5 DofJ/ZRqnDpbKPQ0bsW38AOig3kOc0A27awiBEw3urqR1YkCMwQQAQgAHRYhBH4X CgRchM9GDit5oBDvedn9g1MSBQJbtyScAAoJEBDvedn9g1MSI/oP/0A9J9nrnBMq Zpm857lfYWw+rshLK+tyeP4OQeOqnDFvs9jePpcyJLG3DF2r6VbVKPQq+AE6Uf5h cJBDEN6BjEhRPSbLcqG3A1cz/nNwm8rPmNp+oKhmaBBQGxwciMLmzgynsDydnjPp MyEs04zvsbsl4vrp2095o105l8KcrrxQrioFjbwveGwHQK9bxJKhx9D+gIk+MouB ur45UDKTZkMZrr9FGrtkyXCGAxvKdcNC5Oa8z9sj1rcUJfG/OpVAMWhArdlZbFUQ yoX6pU2Zb1CR2qpWAVerGSfBhmfCyStjARqaKxlftjO+Bj3Jj73Cr5eqej3qB5+V 4BCsPjr4RLvVbYUCPsRdxWc+nBLlfVYkRURu21g1hFm5KFPjgUkyo1s4vjUOY8Dy I+xLGF7f/IhUBG6l+Vswhpwu7ydalZkeFiPx5xna5NfbEYxvsIf71DvipGvIOaHv X4egWoFgm8n/9c3rcMxJtpwHPSsUt5dgLsyu6VE0IbvOAc3dN7CWJ355DVFJq9Zg 2YVf0izSpyyzJeGsgkfjW6xpmdvZxuT2UcN4BTcm6vYqueASGrb3lfhzC5gpeVsc /MoSjTS65vNWbpzONZWMZuLEFraxWJzC0JrDK3NCd0VN3kstqGkVbUIiYOnUm8Vu 4zoVMLlGWzHLIGoPRG2nRezn1YyNfyb5iQGcBBABCgAGBQJbxcflAAoJEGo7ETk8 pK1gE7QL/ApC5P68W5DrI1787WJVZv1u4t/g39vTr7Xer3UMTVQg10vpa7pmqOGh jIDzDMg3Pe3K3M7fVzfAlUA1qw6ne4RCueVoRKpubeF4AlYbMr0K6hNCPjt5uAxm bBVuejKTc6pru5rv5gKL0nDbr+Snft5xt7juBLSSimw0/41sZnkjCxo9rF/RA/v6 +uWyK171RKmsEYu8fFtw1eqUNt/Xj792TUixE3pxXheNtQtZGk/9P3W83ChhG4Fh 5EQsn0pIh9wZIAbMRLpgRKyW87fWHZC8/YH8h7afarvn9Thl5pFUldCe22mNJj6K LChn2aEHQd+PdY1GBpZEcmNEUPuovwzatM0h64hCzTm41eDqRfihZVBT7TbfXQnv 8rywa42Mk756RGzzEZcQEhwQXZcMQUfxIQQ2VyJo0zG36VdZTQF7TF/4Lz7/3cJ5 6jOIm+dwPXtu+C2wAQuD4USOLt4JWPYpqzDfHYJIND/497P9Z9SuQeahr2ez3DRB g3qsHEjBV7QyU3RlcGhlbiBGYXJyZWxsICgyMDE3KSA8c3RlcGhlbi5mYXJyZWxs QGNzLnRjZC5pZT6JAkAEEwEIACoCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwEC HgECF4AFAlo+o3cCGQEACgkQWrL68XsXK+qO0A//ZsfQzyXrZlu/eEV5jU620yeO M3P7SW3C3UQYdCgZ/TlvxGgKow5oDSXgjMiUyq9csGqbPBxlDYSxFZHNeDVKYIuP 2ZK24tw5k6duTh4+sFwUualTMlcp0zBCIzn3hRcsRvuPKHfl5+6oOi0+xqx3jX/s /69L/fvHmdSKet5LIUAxoYaZkTCruFrPWb01tgAl5JExWkhmCY98iD+EeiIMAWBj Mw1xV+p0uCwNbN6XDzcToK7wsm+tAIiWUy3DpP60a6WbVwdV0HNt2WZq5U5Jdh2k 4S+sN2CnYk4tTW7jHjsWarV3FLISCOObADZuB7ljU4kYfdwZ+WzenXY4LGlxGQSl AblGjwZe4EIkCXAJUtzJhoFUuGaF/PlWjxqV3UFRcgTERZTijguVyREre8GNERNg vDxZvuXssEjvz9X5JfcIZDIJpdzhLiEIj9noUbfx1SzB5KDPQj0O7elMHa1671/r wWcpGr/MfVPTOik4H7F8rcVJelceZTzC4tvya7M+jM4fyFWWt8Y4atTixUiP7U9o 4uBZCQ0GzvsmFA4XLqn2pA5rVizMXnGbGOjufAP/efEJ4ul3qvjYe8ye8DXEDjKA xo/tuHYtk19XCi83QzFhWls5TT+XQeVTMEvVqo9Wek8yoxo67qvLKKqIcG9givQd 8MxYNAbNYgSPtkbhZ8SJARwEEAEIAAYFAlo9UqAACgkQLzyHNoBfjaLzHAgAlWT6 NXEGtw/r1miKNGcopzvzILQ9oB8rKI9U9EL6tOf/y2V5oYee/GyQDb3ZdoPxxYYc Jf+RyiH1nMoqUIZiZJaf3bJXinDZ5+AdfE++UR2NBvqaNyC6u3r24jo1B/sagKbY tWgsYtRqHLD4IWi37MZrVyjBuF7u14Q07+uhjq6mX2O/tHpCYw/Q82tbeTRPyUf1 WQOAfD1kfBpW9PvAva5Iw9FWeXpCXRzwxnCZhYfGfqtuSw6CPBYLdbikqML6FZ7E DuTBb/8um1wK7Y9bgeIQC+CYjhYB5RXa1tDJRab2Js4luCvSR0w/CgHw26293tlv e2Q6UTrmHxP5U22DlokCPQQTAQgAJwUCWj1QMgIbAwUJCZQmAAULCQgHAgYVCAkK CwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6tJpD/4rrILH+meP07vrx8wW5eYuqCiP GYnh/CXxIF8eLrfbe5d4QRgtq+w6UeQPMyzKRIRiCoBXB2oJLBZHyxBPxZlg33dT MrEGn8QWKx2iNuz9rZMXyOSWFetuO01d/aUPd5BnbLbIyK5of8xCQlXM6KH8bc+9 gQ7edR9mfLTdvBf2FR522hg8BRBM1imKc3vO8v39+qIHHRjuiwxBBCAOhHtHRsZX ripS0uFA07dM46Oi/E8osjx6fQt/lH5z/PN+2adxYSrLSAXfr1oD3RxYNhuWgyGF L64/VCQb1YGjf0Z5MBPnWm9jgUoOY5K9eNSS0L83WeJjlF5+Q/WOgB+rb49Prm2D Feo9+S9f2V53Llz1WIspXJg6f+n9lmHE94MfQj1GAHCzI0FeL19lvM+LhD8jJSCb hrC3+yobyy/AUOs5Z3E+njjX1FF/VCVAs6iOa6i+XG+Y1hh3ir2y1kckJ5auT10M SU8GEZu9ayU4M3o3N9yxOjaoP0NuQ4MMLL/n/u4u94AeZaHPNBXn/hVfVRRmpRXt GKvJtFAEppGEYezB+bLKIm6XlpPkhnwYzleLZ7AMEco2C6QM8QPB3g3JpS3sqRhA 5rEP4lL16BmijmF+CHoPE/zwgKZbKpyVDqvIW5IDgvfIC2X4pbZDRvGIUKaGSB4+ ksZgUUnNyvfQr2p7jokCMwQQAQgAHRYhBH4XCgRchM9GDit5oBDvedn9g1MSBQJb tySbAAoJEBDvedn9g1MSeKkQAJm44jt1kwHgQgeDBKdjdvl0AjE0xVEQxriZ6lP/ l//34YT0auFfzsYIrChSpQXAEtobBAr4Ohw1Us+BZe+H5P8vm6LRuPwozC3SjwfX 4Iec8+9ot6tIVg4sbedDSgb/CCFVjsmIGcQ1P73JLJTBJ6mxYCV/gn3QC6bwDOFo 7kD9FDHCjRN8XfhHQ4Q9cYyt06uF31qG/aumgWYC9geCGgAwiHgwxNYb9GoJ0iZj CROwbYvLTcQgsVUW2bTmsVR13UVKDsdl02sRV7qcVYW6R0a3Ra8KudX+nt25H5DR Gd382KZ5W8pydsy/viTvD9z6v0ulChBYxAedIvGIClrhbxlLEPmIg4ImVOLGqsUg Vm32J95WOjEkk4PEZ12xSDBtwhSJqmJNboWlfmw43KdIbY8zNhffIO3N6O7FsdGx mqyHeLoTpqY+ySVUPpbuyW8ujnI/J//+6hdTZ9dQsEJQlWngKuWOQ5ma58MPSN88 zllsqhZAFQjNxqnkSzL6ZQ+v/jvuRRe16B80AeO55DsmbWsMv/YLLD1mSi7+Khy2 EtMBhgojWwrGMvdLN6X3mnzNJEscYyLxM9tSk+iySP2sLthK0BVgpAzBSdaf/ezI z60P+neHDzteNFf8Mn7lmgYk1amvZoJ29s5+n2HwxyRL5dVMyMdyQmntubbctfqr Z0tIiQGcBBABCgAGBQJbxcflAAoJEGo7ETk8pK1gnCYMAJY4FeIYjlIXGghFWzsB 4fYwK1+iaFpU3fSto5qcrqVtVPjXpwqczqBWeXGyQxiB0kan4OVAXydIeaP8EAuF CA7paP3s9STLJBO3KurkwyRkPW5zo0X7xVqaVToRsX2Ul98KVJoHYQD1KdezEtwl vpNwiiBr42AYR751Vm6JBVAbQXuFpB3c8bUV0OkkRxNFtL8/2PieHar58n5dntGk bPlPkztahsFqktgacIgXHX5vaT+7YeeZ1DWLOYjGO0wNhkOSeroCmxwJUikU7joB p823L7r5KfpqWTPpSCzVstQKZUGmmoE1qCswY/Ud5wvp9SccpIILkRXj0rZRtfnE 5MpL3hjmtNzfDd9qIsJtBJlSB2hZwAsVm1l+EWN9hG3tqyA43niUMy2n6q690of3 berSiQ+kvY/aC9Hx8I+bKzOV9/J2VUTqfaPZa4Uy2rVX5Q2p69n/PMj7mEer0rCL 3j9V16J9c+s0BSkXoKdtYdB0TWVhBgUybd9qtYcwHWvhP7QuU3RlcGhlbiBGYXJy ZWxsIDxzdGVwaGVuQHRvbGVyYW50bmV0d29ya3MuY29tPokCPQQTAQgAJwUCWj1R WgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6jsc EADEcB0WQEZn2AkrzDs1RhL0Lp6cZi0BigofkbcGfdhJyMSs19C0dhvncrAFClVI 6/Udw3yFtDyYtOCf2W3M3A1K6/RfEizCLzTsdFIhni9gOJLlUpXViQtgrlstjk7h qVV3Ooz4BlCqS4cG7rfqf4LQQPpTAuFUEV9I28FBUB2irqC+v4gTysIgpMw0bA1y BU9sX5jE/tRkzqnuzZrkwiobDtRFJ9qp+7O2JtcY4EsVtLAsaodJKc5cF8R4OvB1 n66vxxcgg9Eh4JNWZ47xsaCmAGo1Bcb2jIY35OtgAL7gCGLRSMKTtAaPy1/fEgIq hCljJ9x40Fkn/3r2BX21WC9HFSPFTBz2RluLRzxdgxOrkYK8EiHUPoE5b1AEzZKw 2AbeXfr57f5zYsN3IqfbQLUjMYtUN1wK3Pjb+idD972wyXMWt8uOzlI7b9Ocu+nY m2whBfJv9Pmp3QYTmPz+LB9lH65VNVUSxSXVr5iWXO3qx1HtEiGEqkporMQCTh3T 5Ud3PvMSRBFFKNs9WhJ/Lxz+SV30WLwG6dr5mQqlzAhb4Phc/zekZyXRdS/oDKrB LUucS36O//49JeyRi1QvOfxnfmIqRIAf/k3PoYJmTo5E82//r5Qj3YGlRu78ba0H Arxs+ACD6AnEHHcbswpbtVEKYzlSu0Ar0Dc7vRWM/IyQdIkBHAQQAQgABgUCWj1S oAAKCRAvPIc2gF+NosIsB/9f/29FNla3BJfGIEIDnhrqGD0i9bSa89SqBd++uG06 TQgW5wsqtNcrwn81yZTq6XE6i9VtD4GKfqC0d4KZJr9bnbeD81cI64VOdL8zJWJs 0vj5EIXCobKyX74Kb4uePUyZqwT2Q74I116u/HwA9/FXsPo5isbh4ZqD4t0VHpWk mfq1FPT9a/JPyX46qKqB2Fce/7Qy+SQP1NfkuUlbhUH/JG9aSSYvk3lznNiH41x9 M+FDlL106itXOubrl3oi2fT3fsSedq7uzt+IV0DQEeNaoQAUuwEhdB8IWOMqN2wo DjGVKJftfsSWY9ilZrnDBNDrp0vRqcx33LUMkIw4d7iBiQIzBBABCAAdFiEEfhcK BFyEz0YOK3mgEO952f2DUxIFAlu3JJwACgkQEO952f2DUxJjuw/6ApHSsVTWD4a0 H6FJ23A9Ftpy+aXZ4vYlzkSrfsn2ECrEfK3lXQh/uzwjJUDYZeB1/BQsFZtcYNQO JSSHbQ49BFRLwb1J/wBZG4bbmrkLxnNbKDKQvzxEpclkMW0Dj0J6o7kGrmzIGGrh B+JJN99AcineHRug8ZSFIERRCmigxdhAKU0BFD7P+5HNHltSL3DF1c2fFOf2JrgB KVoE+9RhMZjWNbYetFFLCkjXb5Rpay9zeMm1DxfSTGAnuOwUXW6qq4hnl5+VC/48 ceDZElLLfu7RQUZv44pkSTOWZs+iQoJiHMFHk9wPqyB2Vok1yJ2a2j27WhXrJlPw nZbgJO5RyWDG3p/eVmpl5Uuc2dsfIpR17KnAuWpghK6V+cyFncDoGCl/YG2Mvool sW08FiZh3Ej4dnJjj25TZkeFG74JJDXLvMYpJfSBGnmETv4Dhcm2xPqVMuFuL1qJ lMbVLrMo2GXeo03OzNyvbs+u8WLIaGm5hC7N1CXY8wZs4jo6OJ/expvnc07dEuws 4zT3AiWv3nIouWReRStZy9QkavDocqbyPmilcdPCYk4BsOlzpwwO74hNG7iyl0Kd AlwTxGQ7y0rJou6HYa1TmRhIEr3vKvlW+JfUUrqtjXgsuacTXo4+Ira2JUErL2cY zQMq1j4r1ZyhFnuz93s7Rsx/Nw0+0YuJAZwEEAEKAAYFAlvFx+UACgkQajsROTyk rWCJqwv+NLVPE4sD4sDA2/6Ek7UsRIUkg+S39fhqWsLc4rtw/mDunv8Un61I3K04 fZ2Ry4nF9hZM0a710UvXFbStvrzRJO3EAAcdJR9LTCd19e8UeruQbIee3YT91U4N kC9JMpecfq62/teOAU2e5P3fWYaLs5ZX7zCLwWuBcW2l3SyoljQczM85HhJ3XHm+ FnwQ6D9xRle+lvWTcuC9d1yAyUb8IOospcL2lJTmy8e3r79R24hPlSB4LDe0wEN8 AXbagrcAQZjwyaHyWxjJbTwZ0b43WGdfIqZ1ElOeoffbketPGRmWvx5xUvb2ALFB BdETzV270gs5XDJgJ1SIIKOyDADxwvroTe2jD8C/841eEql5QSow3s/U3zRqk3mt tto8Qw/DN71aeh6dmYSsvd2UjsHw/vofOPRBGxZLEkKTEvMnhmMW9hiKPkPia+Qg evYE020qpKSxLEdWA8nprHwxmGiDNesCfXSC6vm1qfyj5g8HzxSckq9ZaMhKMCo7 vxflUEDuuQINBFo9UDIBEAD6DdHQfMav8OXfhjTteoarOrlJTSdci727xiezGPuB HmpvceBRZgRasdbaMc4HJee+R9+5x/nLPCuy/DxDyIjwIUeJNgc+l7LjI9WfpHTD 8U4xxjvR5Mi7+ToQQUOUNuzT0O0pyuxP1uY3RehHEhOVfBZO59ipSeZL5iQC6T5M sK1SKfs51pLa5ToC1rc8tBJ4zZmxRAyZiYc/AH2uZ/6rYjTTkAn1DVI9DYo2D/zE 4bGjXdJW5pKphFB2lX3dG4I7ODi+5e1H6A/QpCu6z8/ZkIQ+9T1xcX/YwiFeA7Pb TuW/eITbMbI1eV3+fyym9aT7Rsflmp31Zxtr+sZwGGZf00ooMBFmqOS//NUQ/Vf3 vDUew1h5QU1yDaWT3NApvi+XWPH9TPy6TMfZA2FThHf11sX/gDBa5JWQZbptPEcm oazpiKZt91CrFPOaoXDPck/Q61dfmr/oPikfByYnASIM3OwEuXqyQ9JDRfKrem5r +oA/wxWb5jELElAhOpnyqMMvOh7uz1foUssL8MAv2TGXmxpVJ8Nu4je6wf96Z22f Q0D38zud+CKH3bMP3ayXXJBcdPoENrzFbWP5FTg/4TTDJ3vOAHZR5iCunYghx8b7 Ffa4UbkwlD+dh8GiIAtvT51Ac0cO0Wc0Zjc57zPUz1zloMbf+zb1Bsn7DuEQoqj1 gwARAQABiQIlBBgBCAAPBQJaPVAyAhsMBQkJlCYAAAoJEFqy+vF7FyvqrC8P/1tF 6TeR83xD6MasqXyrBjwcLmziaF0Mlkj8k/YUiZ/knb53n97xQnh9yxPv0TT8Wpfd n3BmvqGyh8+ouHX9jMOxiRkMdNhIauVYY/8jmRfBSYWcFkfMzdYasvdLtmYJgx25 2HKTFdeOrszoOjWjEzwmh+tca3AFMu/nB++/KAmi5UJV7zsZ7uYJ5jm97LV5SLjN JIXXM+lHqCDrjDaDhNczmq1LCRlU6/WDjvkuwaVhZG4lXxMDrvKnXMkjseQ2oKjw rIdfQM86H1z5J31lfhqop+of0cimcIsBgSCPu+h96LHuAzeRBCbDKeqrfZtAZAGs okRina9947fRWxXHh3O66ILmXKNRxxWbDkPvYnQWUat8SbSTDoPWrDIGDRIAypqY o3pcN2OE0C1chqgDZQxkr+9kYZQpupOAN2TR+fM7JvbO9coKI8Uqog8CopoMeDQk d0YjcqlB1E0svODHTzcSoRzogDBYDqNLP7qVkNXpcOAXSVioBgiSDf7o5RdS/qmU yXBIeq6I5z8xBcd+BQ/n/9Frkm6K7IKP3ngUP4wEoiPx5ZE5+fPIScGmVUcZIMhk vMvem9XXh1yyhqN14gfjmLwPGdWbrgG8QUe0s2WeWIyss6uTiyF+ZbJSo2XOKVc3 YFMVUUfgyudqAV1wWdZinUk+H3pkqOKoHAy/8fST =3DYzQY -----END PGP PUBLIC KEY BLOCK----- --------------FFC0F366F0339DCF01681200-- --nPl5nibXbsKR3uNV15iL8LqDnKQWG2rre-- --ELxBh7O3fTSMImVUiRPRSLubS44pjL1T9 Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEW7Wm6ldl0sWGPK4nWrL68XsXK+oFAl0KuGgACgkQWrL68XsX K+qFpRAAwTpP2reONZg0UMlv5unnTsrLfzKQ+Y9qlJtTVqa21LMS5Veir/wDb6bP wkok9QANAl4xYIZwWoRLDsQGa3FnMg8T7pLXRkxR269USv16U4NWGfKcCnysdkNx x7spzw01srFiDmYpENV2E32bdb70gI84MNR6URiwo/bTNu0rhUGHKtuBi1Sx60Pq KWPPDri341JowHOtGGtZe7ldI4qbGVMLVBH7gzvCHDR+6M5uu5eGRQ/ouaB1+4ku 1Gu8cz8xcHWzK5LGmUtoXZrH117cJnpZu91RCcsZXWHp+cDjUuwGlczduKvZGSLg M9yt8M3SeNXhsNftr8UXS3M3JWsGzM3hHO/gIBx7cuYVcD4UwyyFTLgtbnqKbTld AzKLW2Tpq0Ai+NGDja2UmZUtkB3ziZ1PyiyvxLG1iNJexsKrxLSMbuYHTo0bpKMw RJ1hHu86E5/Z4kvx9OIlSxGhnr5uv0vEO2ZuHee0xeg5Hgp4tRMDINAkNY7Bo8pZ GlMnkeWiUwvaGd8yvIf3MClN7i8MhWl/MtI0pJKiXjqQUHAZ96QNtOwah/H2pjJb ttJWsn8lT5fqkKsNXBlvvujPFX4j6IERm3tVERksCYSkNPwiJSFxD3JR79kA59Ae +blcZb6i8dnYolUOpNId2zaSf8IQfwASdSCZIVVFy22NhB+e4zI= =/BIJ -----END PGP SIGNATURE----- --ELxBh7O3fTSMImVUiRPRSLubS44pjL1T9-- From nobody Wed Jun 19 18:17:56 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B65021201D8 for ; Wed, 19 Jun 2019 18:17:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id y9uSCd0miXlx for ; Wed, 19 Jun 2019 18:17:46 -0700 (PDT) Received: from mail-lj1-x22e.google.com (mail-lj1-x22e.google.com [IPv6:2a00:1450:4864:20::22e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BD30C120052 for ; Wed, 19 Jun 2019 18:17:45 -0700 (PDT) Received: by mail-lj1-x22e.google.com with SMTP id m23so994379lje.12 for ; Wed, 19 Jun 2019 18:17:45 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=NEgZtrpffSQvDHP6jd4KM7tGCklxVMrB9MV4ZCGGGfA=; b=zKWswXAz09syep4XTt1jscdn41TIU4WBoUsbSyjWiLwM2GDI503Swm1u8EWOkubiWW DvRB/NKdBA9i2IGuFGGPNJf4sjpb6jpamf5BWP7eFhoV9hgK/OUdbUiq3HxEjyl0rb6r VyCZfk2X9kf6UeWVh6e3yEhFfBJ5pwiWNK8z0IJ9Y3KbCR88Mgjx1HLXN3U9hGQaHTJn T9JiuocoVygXM+xp4rrlwrBbU1pjQWKLm8uUFEZrIsp1tukLoo0iZNdDCtdfRGdoATQ+ PRAlP0BeLzAR315w/ElhX6Hjz6I8Z4fzNYIGk2GY+qp8DX9E6KuBU7Ipl9pSncQVwlkQ RbzA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=NEgZtrpffSQvDHP6jd4KM7tGCklxVMrB9MV4ZCGGGfA=; b=VgIi1v3HWUnvLZ5CrGdNBIuuwBXogBuii7mNCugnqdyDx4Jm5EUUfHVu7wqiEOuaCD 4Svoa1dgB623RyTRFCoYXe94xPcmh22A8UaDuXU3V45B5AOKREupvkgR5gGyFqedloPu yLSJRYM/Nu4OC9A7M3MNQLg+Hkk1IjQovTBpfiLlNKLrb6tnLI41jkbRVxJg8qpVrw1O 0HpQeipu2RIBQLywg9/6e8diJ1YxGHXUmznQzVVX7vngiICacFkx0sr7uvNMuYBxxxcS IPax86a/FTcLLngESzqWzE06A9fA8BG4nEH3zCkzWqBu4X9oRi4WpUtqayn3mag5of5P du/Q== X-Gm-Message-State: APjAAAXrKTvS9bSacseVU1WrXVH8sTdVl1tMgNSkwubB9iL8MXTybkbo YllaiAOJnXAORLT0RnQPVezeg1TAi1NHp6/NZeFcug== X-Google-Smtp-Source: APXvYqyqlM/JDeXVv9oF0HS0CgLmS2OPTn1fR/qE3RhNidwP15QRWUPlzV4vnR0rTjNZRUcK5MYPVJrFW5Xd6oLzilE= X-Received: by 2002:a2e:9cd4:: with SMTP id g20mr16465981ljj.205.1560993463918; Wed, 19 Jun 2019 18:17:43 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Eric Rescorla Date: Wed, 19 Jun 2019 18:17:05 -0700 Message-ID: To: Stephen Farrell Cc: "tls@ietf.org" Content-Type: multipart/alternative; boundary="000000000000e9f860058bb71cdc" Archived-At: Subject: Re: [TLS] ESNI and padding X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 20 Jun 2019 01:17:49 -0000 --000000000000e9f860058bb71cdc Content-Type: text/plain; charset="UTF-8" On Wed, Jun 19, 2019 at 3:34 PM Stephen Farrell wrote: > > Hiya, > > TL;DR: I think we ought remove the ESNIKeys.padded_length field, > define a purely algorithmic padding scheme with no configuration > needed and RECOMMEND that people using ESNI don't use names that > are exceptionally long. > > In the web, ESNI is hides the web site to which a browser is > connecting but there are a few ways in which the lengths of > handshake fields could give the game away. So the current > draft provides mechanisms to avoid those issues in the > handshake. But I think we can do better with less. > > (As a side-note - the ESNI spec is not trying, and shouldn't try, > to define how to pad TLS application traffic. While that is something > that will need to be figured out, it's out of scope for ESNI, which > rightly only deals with the handshake IMO.) > > My main problem with the current approach is that a server might not > (easily) know the longest name or certificate that they will serve > for the duration for which one ESNIKeys value is current. I've come > across openssl related code and mails that indicate that server code > accesses the server cert and private key via a DB lookup. That DB > might not be readily searchable for whomever generates the ESNIKeys. > The current draft calls for fixing the padded_length in the ESNIKeys > structure published in the DNS to cover the longest needed. It > could easily be problematic to ensure those don't get out of whack, > leading to avoidable error cases. The current approach also links > the cadence with which one updates the DNS with how often new TLS > server certificates appear, which seems like an undesirable and > unnecessary linkage. And of course, while the length of the > server name is under local control, the length of certificates > is not. > > Separately, I think the current approach will lead to deployments > over-estimating the padding needed "just in case", e.g. CF's > deployment calls for padding to 260 octets (and I've copied > that in mine so far:-) I would assume CF picked that number > for that not-great "just in case" reason but don't know. In any > case, 260 seems wasteful to me and if it ended up widespread > could cause an issue later if the ClientHello gets bigger for > other reasons, and/or if someone started to depend on it for > some weird reason. > > What I'd suggest instead: > > - delete the padded_length field from ESNIKeys, so nobody needs > to configure anything for padding > - clients MUST pad to a multiple of N octets where N is in the > spec (I'd suggest N=32, but any number that's longer than > nearly all real TLS server names would be good) > - we RECOMMEND clients randomly add an additional N octets of > padding with probability X%, perhaps with X=10 (btw - am I > right in thinking that if X% is greater than the percentage > of real names that are longer than N, then we're good?) > - we STRONGLY RECOMMEND that servers choose names shorter than > N octets for hidden web sites > I am not in favor of these changes. They reduce protocol flexibility for servers which know what they are doing and largely can be implemented in the protocol by servers which do know what they are doing. - servers pad Certificate to a multiple of M octets (M=2000 maybe) > Again, this has a huge negative impact on performance and the server can do much better if it's smart. and CertificateVerify to a multiple of O octets (with O=500 maybe) > In addition to the comments above, your number for O is way too large if the server has effectively any information about which algorithms it is using. Even if you know that you only use RSA-2048 (by far the dominant size) then you can do far better than 500. Similarly, if you have the same set of algorithms for all your domains, this does not leak any information. -Ekr > I'd be fine with any minor changes to the above as well > or with another scheme that allows us to get rid of the > ESNIKeys.padded_length field. > > Cheers, > S. > > PS: There was a little discussion of this on github, [1] but > I figure this is really one the WG ought deal with. > > [1] https://github.com/tlswg/draft-ietf-tls-esni/pull/122 > > > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls > --000000000000e9f860058bb71cdc Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Wed, Jun 19, 2019 at 3:34 PM Steph= en Farrell <stephen.farrell= @cs.tcd.ie> wrote:

Hiya,

TL;DR: I think we ought remove the ESNIKeys.padded_length field,
define a purely algorithmic padding scheme with no configuration
needed and RECOMMEND that people using ESNI don't use names that
are exceptionally long.

In the web, ESNI is hides the web site to which a browser is
connecting but there are a few ways in which the lengths of
handshake fields could give the game away. So the current
draft provides mechanisms to avoid those issues in the
handshake. But I think we can do better with less.

(As a side-note - the ESNI spec is not trying, and shouldn't try,
to define how to pad TLS application traffic. While that is something
that will need to be figured out, it's out of scope for ESNI, which
rightly only deals with the handshake IMO.)

My main problem with the current approach is that a server might not
(easily) know the longest name or certificate that they will serve
for the duration for which one ESNIKeys value is current.=C2=A0 I've co= me
across openssl related code and mails that indicate that server code
accesses the server cert and private key via a DB lookup.=C2=A0 That DB
might not be readily searchable for whomever generates the ESNIKeys.
The current draft calls for fixing the padded_length in the ESNIKeys
structure published in the DNS to cover the longest needed.=C2=A0 It
could easily be problematic to ensure those don't get out of whack,
leading to avoidable error cases. The current approach also links
the cadence with which one updates the DNS with how often new TLS
server certificates appear, which seems like an undesirable and
unnecessary linkage. And of course, while the length of the
server name is under local control, the length of certificates
is not.

Separately, I think the current approach will lead to deployments
over-estimating the padding needed "just in case", e.g. CF's<= br> deployment calls for padding to 260 octets (and I've copied
that in mine so far:-) I would assume CF picked that number
for that not-great "just in case" reason but don't know. In a= ny
case, 260 seems wasteful to me and if it ended up widespread
could cause an issue later if the ClientHello gets bigger for
other reasons, and/or if someone started to depend on it for
some weird reason.

What I'd suggest instead:

- delete the padded_length field from ESNIKeys, so nobody needs
=C2=A0 to configure anything for padding
- clients MUST pad to a multiple of N octets where N is in the
=C2=A0 spec (I'd suggest N=3D32, but any number that's longer than<= br> =C2=A0 nearly all real TLS server names would be good)
- we RECOMMEND clients randomly add an additional N octets of
=C2=A0 padding with probability X%, perhaps with X=3D10 (btw - am I
=C2=A0 right in thinking that if X% is greater than the percentage
=C2=A0 of real names that are longer than N, then we're good?)
- we STRONGLY RECOMMEND that servers choose names shorter than
=C2=A0 N octets for hidden web sites

I = am not in favor of these changes.=C2=A0 They reduce protocol flexibility fo= r servers
which know what they are doing and largely can be imple= mented in the protocol
by servers which do know what they are doi= ng.


- servers pad Certificate to a multiple of M octets (M=3D2000 maybe)

Again, this has a huge negative impact on per= formance and the server can
do much better if it's smart.
=

=C2=A0 and CertificateVerify to a multiple of O octets (with O=3D500 maybe)=

In addition to the comments above, you= r number for O is way too large
if the server has effectively any= information about which algorithms it is
using. Even if you know= that you only use RSA-2048 (by far the dominant
size) then you c= an do far better than 500. Similarly, if you have the same
set of= algorithms for all your domains, this does not leak any information.

-Ekr









I'd be fine with any minor changes to the above as well
or with another scheme that allows us to get rid of the
ESNIKeys.padded_length field.

Cheers,
S.

PS: There was a little discussion of this on github, [1] but
I figure this is really one the WG ought deal with.

[1] https://github.com/tlswg/draft-ietf-tls-e= sni/pull/122


_______________________________________________
TLS mailing list
TLS@ietf.org
https://www.ietf.org/mailman/listinfo/tls
--000000000000e9f860058bb71cdc-- From nobody Thu Jun 20 01:20:37 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3141F120116 for ; Thu, 20 Jun 2019 01:20:36 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.3 X-Spam-Level: X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9Txl4Okf-jNr for ; Thu, 20 Jun 2019 01:20:32 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 867B312004F for ; Thu, 20 Jun 2019 01:20:31 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id 8665CBE79; Thu, 20 Jun 2019 09:20:29 +0100 (IST) X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id L6vEvLFho7gt; Thu, 20 Jun 2019 09:20:28 +0100 (IST) Received: from [10.244.2.138] (95-45-153-252-dynamic.agg2.phb.bdt-fng.eircom.net [95.45.153.252]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id DDE61BE73; Thu, 20 Jun 2019 09:20:27 +0100 (IST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1561018827; bh=s1y4qQ5s5vnHjQY5ioRw/WMxQyM3Y7nXrzA71BDlZRw=; h=To:Cc:References:From:Subject:Date:In-Reply-To:From; b=BgahKdMFgC/HssH/9UVdWil1fwHZ/0plSr87qwik1VLfE4V4JA0UqUY9DE8fbpplZ bScO6LtNA6tDdxg7YWPjbvaf7F6lcc0IO6jw8qFpHVYJ7eHJ5n2xhOWigPbkIUyuXu Gp1gnc8yVXnbAK1u2xdcTwhKARkNjJDV71X+/7ro= To: Eric Rescorla Cc: "tls@ietf.org" References: From: Stephen Farrell Openpgp: id=5BB5A6EA5765D2C5863CAE275AB2FAF17B172BEA; url= Autocrypt: addr=stephen.farrell@cs.tcd.ie; prefer-encrypt=mutual; keydata= mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nemCP5PMvmh 5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kTq0IqYzsEv5HI58S+ QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtEgvw4fVhVWJuyy3w//0F2tzKr EMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy+pAh4EKzS1FE7BOZp9daMu9MUQmDqtZU bUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqO Vz+7L+WiVfxLbeVqBwV+4uL9to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJg b097ZaNyuY1ETghVB5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k 4LyM2lp5FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9tlyWxn5Xi HzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQABtDJTdGVwaGVuIEZh cnJlbGwgKDIwMTcpIDxzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPokCQAQTAQgAKgIbAwUJ CZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAUCWj6jdwIZAQAKCRBasvrxexcr6o7QD/9m x9DPJetmW794RXmNTrbTJ44zc/tJbcLdRBh0KBn9OW/EaAqjDmgNJeCMyJTKr1ywaps8HGUN hLEVkc14NUpgi4/Zkrbi3DmTp25OHj6wXBS5qVMyVynTMEIjOfeFFyxG+48od+Xn7qg6LT7G rHeNf+z/r0v9+8eZ1Ip63kshQDGhhpmRMKu4Ws9ZvTW2ACXkkTFaSGYJj3yIP4R6IgwBYGMz DXFX6nS4LA1s3pcPNxOgrvCyb60AiJZTLcOk/rRrpZtXB1XQc23ZZmrlTkl2HaThL6w3YKdi Ti1NbuMeOxZqtXcUshII45sANm4HuWNTiRh93Bn5bN6ddjgsaXEZBKUBuUaPBl7gQiQJcAlS 3MmGgVS4ZoX8+VaPGpXdQVFyBMRFlOKOC5XJESt7wY0RE2C8PFm+5eywSO/P1fkl9whkMgml 3OEuIQiP2ehRt/HVLMHkoM9CPQ7t6UwdrXrvX+vBZykav8x9U9M6KTgfsXytxUl6Vx5lPMLi 2/Jrsz6Mzh/IVZa3xjhq1OLFSI/tT2ji4FkJDQbO+yYUDhcuqfakDmtWLMxecZsY6O58A/95 8Qni6Xeq+Nh7zJ7wNcQOMoDGj+24di2TX1cKLzdDMWFaWzlNP5dB5VMwS9Wqj1Z6TzKjGjru q8soqohwb2CK9B3wzFg0Bs1iBI+2RuFnxLkCDQRaPVAyARAA+g3R0HzGr/Dl34Y07XqGqzq5 SU0nXIu9u8Ynsxj7gR5qb3HgUWYEWrHW2jHOByXnvkffucf5yzwrsvw8Q8iI8CFHiTYHPpey 4yPVn6R0w/FOMcY70eTIu/k6EEFDlDbs09DtKcrsT9bmN0XoRxITlXwWTufYqUnmS+YkAuk+ TLCtUin7OdaS2uU6Ata3PLQSeM2ZsUQMmYmHPwB9rmf+q2I005AJ9Q1SPQ2KNg/8xOGxo13S VuaSqYRQdpV93RuCOzg4vuXtR+gP0KQrus/P2ZCEPvU9cXF/2MIhXgOz207lv3iE2zGyNXld /n8spvWk+0bH5Zqd9Wcba/rGcBhmX9NKKDARZqjkv/zVEP1X97w1HsNYeUFNcg2lk9zQKb4v l1jx/Uz8ukzH2QNhU4R39dbF/4AwWuSVkGW6bTxHJqGs6YimbfdQqxTzmqFwz3JP0OtXX5q/ 6D4pHwcmJwEiDNzsBLl6skPSQ0Xyq3pua/qAP8MVm+YxCxJQITqZ8qjDLzoe7s9X6FLLC/DA L9kxl5saVSfDbuI3usH/emdtn0NA9/M7nfgih92zD92sl1yQXHT6BDa8xW1j+RU4P+E0wyd7 zgB2UeYgrp2IIcfG+xX2uFG5MJQ/nYfBoiALb0+dQHNHDtFnNGY3Oe8z1M9c5aDG3/s29QbJ +w7hEKKo9YMAEQEAAYkCJQQYAQgADwUCWj1QMgIbDAUJCZQmAAAKCRBasvrxexcr6qwvD/9b Rek3kfN8Q+jGrKl8qwY8HC5s4mhdDJZI/JP2FImf5J2+d5/e8UJ4fcsT79E0/FqX3Z9wZr6h sofPqLh1/YzDsYkZDHTYSGrlWGP/I5kXwUmFnBZHzM3WGrL3S7ZmCYMdudhykxXXjq7M6Do1 oxM8JofrXGtwBTLv5wfvvygJouVCVe87Ge7mCeY5vey1eUi4zSSF1zPpR6gg64w2g4TXM5qt SwkZVOv1g475LsGlYWRuJV8TA67yp1zJI7HkNqCo8KyHX0DPOh9c+Sd9ZX4aqKfqH9HIpnCL AYEgj7vofeix7gM3kQQmwynqq32bQGQBrKJEYp2vfeO30VsVx4dzuuiC5lyjUccVmw5D72J0 FlGrfEm0kw6D1qwyBg0SAMqamKN6XDdjhNAtXIaoA2UMZK/vZGGUKbqTgDdk0fnzOyb2zvXK CiPFKqIPAqKaDHg0JHdGI3KpQdRNLLzgx083EqEc6IAwWA6jSz+6lZDV6XDgF0lYqAYIkg3+ 6OUXUv6plMlwSHquiOc/MQXHfgUP5//Ra5JuiuyCj954FD+MBKIj8eWROfnzyEnBplVHGSDI ZLzL3pvV14dcsoajdeIH45i8DxnVm64BvEFHtLNlnliMrLOrk4shfmWyUqNlzilXN2BTFVFH 4MrnagFdcFnWYp1JPh96ZKjiqBwMv/H0kw== Message-ID: <73fc5d1e-12ad-db81-6f0b-702d9230a2bf@cs.tcd.ie> Date: Thu, 20 Jun 2019 09:20:26 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.7.0 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="88DgKbyE7wCFzhqkL5zw7FJtZndnZWxWS" Archived-At: Subject: Re: [TLS] ESNI and padding X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 20 Jun 2019 08:20:36 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --88DgKbyE7wCFzhqkL5zw7FJtZndnZWxWS Content-Type: multipart/mixed; boundary="bntmW1S6IzLLC5KpJn1iWj2yxIAcb48MF"; protected-headers="v1" From: Stephen Farrell To: Eric Rescorla Cc: "tls@ietf.org" Message-ID: <73fc5d1e-12ad-db81-6f0b-702d9230a2bf@cs.tcd.ie> Subject: Re: [TLS] ESNI and padding References: In-Reply-To: --bntmW1S6IzLLC5KpJn1iWj2yxIAcb48MF Content-Type: multipart/mixed; boundary="------------AE307C5FD6447DD7C6091370" Content-Language: en-GB This is a multi-part message in MIME format. --------------AE307C5FD6447DD7C6091370 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hiya, On 20/06/2019 02:17, Eric Rescorla wrote: > I am not in favor of these changes. They reduce protocol flexibility f= or > servers I don't see being asked to configure a new thing that has subtle relationships with other things that aren't always under the control of one entity as "flexibility." I see that as a burden, and maybe as a protocol design bug. > which know what they are doing and largely can be implemented in the > protocol > by servers which do know what they are doing. That kind of anthropomorphism often seems to me to indicate a weak argument:-) Servers don't "know" anything - the question is whether the current setup could cause problems for a range of possible deployments, and I think it could if there's less tight coupling between how ESNIKeys get generated and published and how names and certificates are handled. IIUC that kind of setup does exist in the wild. To give an example, say some hoster is doing ESNI and has set padded_length to 55. If a new customer turns up with a 56 octet name, then that hoster has to unexpectedly touch ESNIKeys or deal with possibly weird ESNI problems for at least a TTL. If we had an algorithmic approach it should just continue to work. Characterising that hoster as "not knowing what they're doing" seems to me wrong. I think that'd be more a case of us not knowing what we're doing:-) As to the specific numbers in my mail - I don't much care what's picked, and do agree that some measurements would help pick good numbers. I also agree that CertificateVerify is much less of a concern in reality. But asking that Certificate be padded "such that its length equals the size of the largest possible Certificate (message) covered by the same ESNI key" would in some cases require a new database search for each TLS session. And since the Certificate message is the path and not one certificate that could be quite expensive to impractical depending how a server stores/builds paths. I also believe that some openssl deployments do this via locally implemented callbacks so it'd be hard to know how badly or not the current approach might affect those. Cheers, S. --------------AE307C5FD6447DD7C6091370 Content-Type: application/pgp-keys; name="0x5AB2FAF17B172BEA.asc" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="0x5AB2FAF17B172BEA.asc" -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nem CP5PMvmh5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kT q0IqYzsEv5HI58S+QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtE gvw4fVhVWJuyy3w//0F2tzKrEMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy +pAh4EKzS1FE7BOZp9daMu9MUQmDqtZUbUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5 iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqOVz+7L+WiVfxLbeVqBwV+4uL9 to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJgb097ZaNyuY1ETghV B5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k4LyM2lp5 FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9t lyWxn5XiHzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQAB tCFTdGVwaGVuIEZhcnJlbGwgPHN0ZXBoZW5AamVsbC5pZT6JAj0EEwEIACcFAlo9 UYwCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQWrL68XsXK+qG CxAApYHWYgGOIL3G6/OpkejdAkQoCVQAK8LJUSf6vzwost4iVfxIKcKW/3RqKNKk rRl8beJ7j1CWXAz9+VXAOsE9+zNxXIDgGA7HlvJnhffl+qwibVgiHgUcJFhCSbBr sjC+1uULaTU8zYEyET//GOGPLF+X+degkE/sesh4zcEAjF7fGPnlncdCCH3tvPZZ sdTcjwOCRVonKsDgQzBTCMz/RPBfEFX44HZx4g1UQAcCA4xlucY8QkJEyCrSNGpG nvGK8DcGSmnstl1/a9fnlhpdFxieX3oY2phJ1WKkYTn6Advrek3UP71CKxpgtPmk d3iUUz/VZa0Cv6YxQXskspRDVEvdCMYSQBtJPQ4y2+5UxVR9GIQXenwYp9AP2niv Voh+ITsDWWeWnnvYMq07rSDjq0nGdj41MJkNX+Yb2PXVyXItcj5ybE3T2+y3pSBG FEZYJGuaL4NwtBJFMOdOtBmUOPbetS2971EL3Izxb7ibOZWDwexv+8R6SWYfP1wV N3p46RyBQuXqJV8ccE11m6vtZTGSYgnLUUFZMRQYH+0hwuYe0T3AA18xDdSYsa8v ovCCd3l5S4UNzIM2PMChqGrEzKapUpZg7+8ACcxRU3b9Ihd7WYjJ+pQPCoWYKozv tEvenbNpE/govO/ED3B14e+R2yevRPjRrsN7PJzSf15fQLuJARwEEAEIAAYFAlo9 UqAACgkQLzyHNoBfjaLrSwf+MIHbFRQ4O5cmLYR5sIByWelN3SuRN/gW8rpKo9Ok Cz6An8uV/iCXy5tNMLzzi0BFl8f22DwBcC5qy9qnlIAdogWam1qWoTAoAD8veEqm uKhYrqJsCcAyNrKYmK0hP3rpHxx1LySDmKYXmw/8qtBXKHTouMm+5tSsznhykRMT AAr2p7PSaHgo+hIVaW/rKSspHjDhhZS+G9mtOZad1IH29M6G1Q1NCO0Ywe8krKLQ IAQlFxtgvOqpPOZNzeKBa/+KbE8TGgMWrkOhC8OeEM5PVzdDhlhD9kPzB/pCKDF5 DofJ/ZRqnDpbKPQ0bsW38AOig3kOc0A27awiBEw3urqR1YkCMwQQAQgAHRYhBH4X CgRchM9GDit5oBDvedn9g1MSBQJbtyScAAoJEBDvedn9g1MSI/oP/0A9J9nrnBMq Zpm857lfYWw+rshLK+tyeP4OQeOqnDFvs9jePpcyJLG3DF2r6VbVKPQq+AE6Uf5h cJBDEN6BjEhRPSbLcqG3A1cz/nNwm8rPmNp+oKhmaBBQGxwciMLmzgynsDydnjPp MyEs04zvsbsl4vrp2095o105l8KcrrxQrioFjbwveGwHQK9bxJKhx9D+gIk+MouB ur45UDKTZkMZrr9FGrtkyXCGAxvKdcNC5Oa8z9sj1rcUJfG/OpVAMWhArdlZbFUQ yoX6pU2Zb1CR2qpWAVerGSfBhmfCyStjARqaKxlftjO+Bj3Jj73Cr5eqej3qB5+V 4BCsPjr4RLvVbYUCPsRdxWc+nBLlfVYkRURu21g1hFm5KFPjgUkyo1s4vjUOY8Dy I+xLGF7f/IhUBG6l+Vswhpwu7ydalZkeFiPx5xna5NfbEYxvsIf71DvipGvIOaHv X4egWoFgm8n/9c3rcMxJtpwHPSsUt5dgLsyu6VE0IbvOAc3dN7CWJ355DVFJq9Zg 2YVf0izSpyyzJeGsgkfjW6xpmdvZxuT2UcN4BTcm6vYqueASGrb3lfhzC5gpeVsc /MoSjTS65vNWbpzONZWMZuLEFraxWJzC0JrDK3NCd0VN3kstqGkVbUIiYOnUm8Vu 4zoVMLlGWzHLIGoPRG2nRezn1YyNfyb5iQGcBBABCgAGBQJbxcflAAoJEGo7ETk8 pK1gE7QL/ApC5P68W5DrI1787WJVZv1u4t/g39vTr7Xer3UMTVQg10vpa7pmqOGh jIDzDMg3Pe3K3M7fVzfAlUA1qw6ne4RCueVoRKpubeF4AlYbMr0K6hNCPjt5uAxm bBVuejKTc6pru5rv5gKL0nDbr+Snft5xt7juBLSSimw0/41sZnkjCxo9rF/RA/v6 +uWyK171RKmsEYu8fFtw1eqUNt/Xj792TUixE3pxXheNtQtZGk/9P3W83ChhG4Fh 5EQsn0pIh9wZIAbMRLpgRKyW87fWHZC8/YH8h7afarvn9Thl5pFUldCe22mNJj6K LChn2aEHQd+PdY1GBpZEcmNEUPuovwzatM0h64hCzTm41eDqRfihZVBT7TbfXQnv 8rywa42Mk756RGzzEZcQEhwQXZcMQUfxIQQ2VyJo0zG36VdZTQF7TF/4Lz7/3cJ5 6jOIm+dwPXtu+C2wAQuD4USOLt4JWPYpqzDfHYJIND/497P9Z9SuQeahr2ez3DRB g3qsHEjBV7QyU3RlcGhlbiBGYXJyZWxsICgyMDE3KSA8c3RlcGhlbi5mYXJyZWxs QGNzLnRjZC5pZT6JAkAEEwEIACoCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwEC HgECF4AFAlo+o3cCGQEACgkQWrL68XsXK+qO0A//ZsfQzyXrZlu/eEV5jU620yeO M3P7SW3C3UQYdCgZ/TlvxGgKow5oDSXgjMiUyq9csGqbPBxlDYSxFZHNeDVKYIuP 2ZK24tw5k6duTh4+sFwUualTMlcp0zBCIzn3hRcsRvuPKHfl5+6oOi0+xqx3jX/s /69L/fvHmdSKet5LIUAxoYaZkTCruFrPWb01tgAl5JExWkhmCY98iD+EeiIMAWBj Mw1xV+p0uCwNbN6XDzcToK7wsm+tAIiWUy3DpP60a6WbVwdV0HNt2WZq5U5Jdh2k 4S+sN2CnYk4tTW7jHjsWarV3FLISCOObADZuB7ljU4kYfdwZ+WzenXY4LGlxGQSl AblGjwZe4EIkCXAJUtzJhoFUuGaF/PlWjxqV3UFRcgTERZTijguVyREre8GNERNg vDxZvuXssEjvz9X5JfcIZDIJpdzhLiEIj9noUbfx1SzB5KDPQj0O7elMHa1671/r wWcpGr/MfVPTOik4H7F8rcVJelceZTzC4tvya7M+jM4fyFWWt8Y4atTixUiP7U9o 4uBZCQ0GzvsmFA4XLqn2pA5rVizMXnGbGOjufAP/efEJ4ul3qvjYe8ye8DXEDjKA xo/tuHYtk19XCi83QzFhWls5TT+XQeVTMEvVqo9Wek8yoxo67qvLKKqIcG9givQd 8MxYNAbNYgSPtkbhZ8SJARwEEAEIAAYFAlo9UqAACgkQLzyHNoBfjaLzHAgAlWT6 NXEGtw/r1miKNGcopzvzILQ9oB8rKI9U9EL6tOf/y2V5oYee/GyQDb3ZdoPxxYYc Jf+RyiH1nMoqUIZiZJaf3bJXinDZ5+AdfE++UR2NBvqaNyC6u3r24jo1B/sagKbY tWgsYtRqHLD4IWi37MZrVyjBuF7u14Q07+uhjq6mX2O/tHpCYw/Q82tbeTRPyUf1 WQOAfD1kfBpW9PvAva5Iw9FWeXpCXRzwxnCZhYfGfqtuSw6CPBYLdbikqML6FZ7E DuTBb/8um1wK7Y9bgeIQC+CYjhYB5RXa1tDJRab2Js4luCvSR0w/CgHw26293tlv e2Q6UTrmHxP5U22DlokCPQQTAQgAJwUCWj1QMgIbAwUJCZQmAAULCQgHAgYVCAkK CwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6tJpD/4rrILH+meP07vrx8wW5eYuqCiP GYnh/CXxIF8eLrfbe5d4QRgtq+w6UeQPMyzKRIRiCoBXB2oJLBZHyxBPxZlg33dT MrEGn8QWKx2iNuz9rZMXyOSWFetuO01d/aUPd5BnbLbIyK5of8xCQlXM6KH8bc+9 gQ7edR9mfLTdvBf2FR522hg8BRBM1imKc3vO8v39+qIHHRjuiwxBBCAOhHtHRsZX ripS0uFA07dM46Oi/E8osjx6fQt/lH5z/PN+2adxYSrLSAXfr1oD3RxYNhuWgyGF L64/VCQb1YGjf0Z5MBPnWm9jgUoOY5K9eNSS0L83WeJjlF5+Q/WOgB+rb49Prm2D Feo9+S9f2V53Llz1WIspXJg6f+n9lmHE94MfQj1GAHCzI0FeL19lvM+LhD8jJSCb hrC3+yobyy/AUOs5Z3E+njjX1FF/VCVAs6iOa6i+XG+Y1hh3ir2y1kckJ5auT10M SU8GEZu9ayU4M3o3N9yxOjaoP0NuQ4MMLL/n/u4u94AeZaHPNBXn/hVfVRRmpRXt GKvJtFAEppGEYezB+bLKIm6XlpPkhnwYzleLZ7AMEco2C6QM8QPB3g3JpS3sqRhA 5rEP4lL16BmijmF+CHoPE/zwgKZbKpyVDqvIW5IDgvfIC2X4pbZDRvGIUKaGSB4+ ksZgUUnNyvfQr2p7jokCMwQQAQgAHRYhBH4XCgRchM9GDit5oBDvedn9g1MSBQJb tySbAAoJEBDvedn9g1MSeKkQAJm44jt1kwHgQgeDBKdjdvl0AjE0xVEQxriZ6lP/ l//34YT0auFfzsYIrChSpQXAEtobBAr4Ohw1Us+BZe+H5P8vm6LRuPwozC3SjwfX 4Iec8+9ot6tIVg4sbedDSgb/CCFVjsmIGcQ1P73JLJTBJ6mxYCV/gn3QC6bwDOFo 7kD9FDHCjRN8XfhHQ4Q9cYyt06uF31qG/aumgWYC9geCGgAwiHgwxNYb9GoJ0iZj CROwbYvLTcQgsVUW2bTmsVR13UVKDsdl02sRV7qcVYW6R0a3Ra8KudX+nt25H5DR Gd382KZ5W8pydsy/viTvD9z6v0ulChBYxAedIvGIClrhbxlLEPmIg4ImVOLGqsUg Vm32J95WOjEkk4PEZ12xSDBtwhSJqmJNboWlfmw43KdIbY8zNhffIO3N6O7FsdGx mqyHeLoTpqY+ySVUPpbuyW8ujnI/J//+6hdTZ9dQsEJQlWngKuWOQ5ma58MPSN88 zllsqhZAFQjNxqnkSzL6ZQ+v/jvuRRe16B80AeO55DsmbWsMv/YLLD1mSi7+Khy2 EtMBhgojWwrGMvdLN6X3mnzNJEscYyLxM9tSk+iySP2sLthK0BVgpAzBSdaf/ezI z60P+neHDzteNFf8Mn7lmgYk1amvZoJ29s5+n2HwxyRL5dVMyMdyQmntubbctfqr Z0tIiQGcBBABCgAGBQJbxcflAAoJEGo7ETk8pK1gnCYMAJY4FeIYjlIXGghFWzsB 4fYwK1+iaFpU3fSto5qcrqVtVPjXpwqczqBWeXGyQxiB0kan4OVAXydIeaP8EAuF CA7paP3s9STLJBO3KurkwyRkPW5zo0X7xVqaVToRsX2Ul98KVJoHYQD1KdezEtwl vpNwiiBr42AYR751Vm6JBVAbQXuFpB3c8bUV0OkkRxNFtL8/2PieHar58n5dntGk bPlPkztahsFqktgacIgXHX5vaT+7YeeZ1DWLOYjGO0wNhkOSeroCmxwJUikU7joB p823L7r5KfpqWTPpSCzVstQKZUGmmoE1qCswY/Ud5wvp9SccpIILkRXj0rZRtfnE 5MpL3hjmtNzfDd9qIsJtBJlSB2hZwAsVm1l+EWN9hG3tqyA43niUMy2n6q690of3 berSiQ+kvY/aC9Hx8I+bKzOV9/J2VUTqfaPZa4Uy2rVX5Q2p69n/PMj7mEer0rCL 3j9V16J9c+s0BSkXoKdtYdB0TWVhBgUybd9qtYcwHWvhP7QuU3RlcGhlbiBGYXJy ZWxsIDxzdGVwaGVuQHRvbGVyYW50bmV0d29ya3MuY29tPokCPQQTAQgAJwUCWj1R WgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6jsc EADEcB0WQEZn2AkrzDs1RhL0Lp6cZi0BigofkbcGfdhJyMSs19C0dhvncrAFClVI 6/Udw3yFtDyYtOCf2W3M3A1K6/RfEizCLzTsdFIhni9gOJLlUpXViQtgrlstjk7h qVV3Ooz4BlCqS4cG7rfqf4LQQPpTAuFUEV9I28FBUB2irqC+v4gTysIgpMw0bA1y BU9sX5jE/tRkzqnuzZrkwiobDtRFJ9qp+7O2JtcY4EsVtLAsaodJKc5cF8R4OvB1 n66vxxcgg9Eh4JNWZ47xsaCmAGo1Bcb2jIY35OtgAL7gCGLRSMKTtAaPy1/fEgIq hCljJ9x40Fkn/3r2BX21WC9HFSPFTBz2RluLRzxdgxOrkYK8EiHUPoE5b1AEzZKw 2AbeXfr57f5zYsN3IqfbQLUjMYtUN1wK3Pjb+idD972wyXMWt8uOzlI7b9Ocu+nY m2whBfJv9Pmp3QYTmPz+LB9lH65VNVUSxSXVr5iWXO3qx1HtEiGEqkporMQCTh3T 5Ud3PvMSRBFFKNs9WhJ/Lxz+SV30WLwG6dr5mQqlzAhb4Phc/zekZyXRdS/oDKrB LUucS36O//49JeyRi1QvOfxnfmIqRIAf/k3PoYJmTo5E82//r5Qj3YGlRu78ba0H Arxs+ACD6AnEHHcbswpbtVEKYzlSu0Ar0Dc7vRWM/IyQdIkBHAQQAQgABgUCWj1S oAAKCRAvPIc2gF+NosIsB/9f/29FNla3BJfGIEIDnhrqGD0i9bSa89SqBd++uG06 TQgW5wsqtNcrwn81yZTq6XE6i9VtD4GKfqC0d4KZJr9bnbeD81cI64VOdL8zJWJs 0vj5EIXCobKyX74Kb4uePUyZqwT2Q74I116u/HwA9/FXsPo5isbh4ZqD4t0VHpWk mfq1FPT9a/JPyX46qKqB2Fce/7Qy+SQP1NfkuUlbhUH/JG9aSSYvk3lznNiH41x9 M+FDlL106itXOubrl3oi2fT3fsSedq7uzt+IV0DQEeNaoQAUuwEhdB8IWOMqN2wo DjGVKJftfsSWY9ilZrnDBNDrp0vRqcx33LUMkIw4d7iBiQIzBBABCAAdFiEEfhcK BFyEz0YOK3mgEO952f2DUxIFAlu3JJwACgkQEO952f2DUxJjuw/6ApHSsVTWD4a0 H6FJ23A9Ftpy+aXZ4vYlzkSrfsn2ECrEfK3lXQh/uzwjJUDYZeB1/BQsFZtcYNQO JSSHbQ49BFRLwb1J/wBZG4bbmrkLxnNbKDKQvzxEpclkMW0Dj0J6o7kGrmzIGGrh B+JJN99AcineHRug8ZSFIERRCmigxdhAKU0BFD7P+5HNHltSL3DF1c2fFOf2JrgB KVoE+9RhMZjWNbYetFFLCkjXb5Rpay9zeMm1DxfSTGAnuOwUXW6qq4hnl5+VC/48 ceDZElLLfu7RQUZv44pkSTOWZs+iQoJiHMFHk9wPqyB2Vok1yJ2a2j27WhXrJlPw nZbgJO5RyWDG3p/eVmpl5Uuc2dsfIpR17KnAuWpghK6V+cyFncDoGCl/YG2Mvool sW08FiZh3Ej4dnJjj25TZkeFG74JJDXLvMYpJfSBGnmETv4Dhcm2xPqVMuFuL1qJ lMbVLrMo2GXeo03OzNyvbs+u8WLIaGm5hC7N1CXY8wZs4jo6OJ/expvnc07dEuws 4zT3AiWv3nIouWReRStZy9QkavDocqbyPmilcdPCYk4BsOlzpwwO74hNG7iyl0Kd AlwTxGQ7y0rJou6HYa1TmRhIEr3vKvlW+JfUUrqtjXgsuacTXo4+Ira2JUErL2cY zQMq1j4r1ZyhFnuz93s7Rsx/Nw0+0YuJAZwEEAEKAAYFAlvFx+UACgkQajsROTyk rWCJqwv+NLVPE4sD4sDA2/6Ek7UsRIUkg+S39fhqWsLc4rtw/mDunv8Un61I3K04 fZ2Ry4nF9hZM0a710UvXFbStvrzRJO3EAAcdJR9LTCd19e8UeruQbIee3YT91U4N kC9JMpecfq62/teOAU2e5P3fWYaLs5ZX7zCLwWuBcW2l3SyoljQczM85HhJ3XHm+ FnwQ6D9xRle+lvWTcuC9d1yAyUb8IOospcL2lJTmy8e3r79R24hPlSB4LDe0wEN8 AXbagrcAQZjwyaHyWxjJbTwZ0b43WGdfIqZ1ElOeoffbketPGRmWvx5xUvb2ALFB BdETzV270gs5XDJgJ1SIIKOyDADxwvroTe2jD8C/841eEql5QSow3s/U3zRqk3mt tto8Qw/DN71aeh6dmYSsvd2UjsHw/vofOPRBGxZLEkKTEvMnhmMW9hiKPkPia+Qg evYE020qpKSxLEdWA8nprHwxmGiDNesCfXSC6vm1qfyj5g8HzxSckq9ZaMhKMCo7 vxflUEDuuQINBFo9UDIBEAD6DdHQfMav8OXfhjTteoarOrlJTSdci727xiezGPuB HmpvceBRZgRasdbaMc4HJee+R9+5x/nLPCuy/DxDyIjwIUeJNgc+l7LjI9WfpHTD 8U4xxjvR5Mi7+ToQQUOUNuzT0O0pyuxP1uY3RehHEhOVfBZO59ipSeZL5iQC6T5M sK1SKfs51pLa5ToC1rc8tBJ4zZmxRAyZiYc/AH2uZ/6rYjTTkAn1DVI9DYo2D/zE 4bGjXdJW5pKphFB2lX3dG4I7ODi+5e1H6A/QpCu6z8/ZkIQ+9T1xcX/YwiFeA7Pb TuW/eITbMbI1eV3+fyym9aT7Rsflmp31Zxtr+sZwGGZf00ooMBFmqOS//NUQ/Vf3 vDUew1h5QU1yDaWT3NApvi+XWPH9TPy6TMfZA2FThHf11sX/gDBa5JWQZbptPEcm oazpiKZt91CrFPOaoXDPck/Q61dfmr/oPikfByYnASIM3OwEuXqyQ9JDRfKrem5r +oA/wxWb5jELElAhOpnyqMMvOh7uz1foUssL8MAv2TGXmxpVJ8Nu4je6wf96Z22f Q0D38zud+CKH3bMP3ayXXJBcdPoENrzFbWP5FTg/4TTDJ3vOAHZR5iCunYghx8b7 Ffa4UbkwlD+dh8GiIAtvT51Ac0cO0Wc0Zjc57zPUz1zloMbf+zb1Bsn7DuEQoqj1 gwARAQABiQIlBBgBCAAPBQJaPVAyAhsMBQkJlCYAAAoJEFqy+vF7FyvqrC8P/1tF 6TeR83xD6MasqXyrBjwcLmziaF0Mlkj8k/YUiZ/knb53n97xQnh9yxPv0TT8Wpfd n3BmvqGyh8+ouHX9jMOxiRkMdNhIauVYY/8jmRfBSYWcFkfMzdYasvdLtmYJgx25 2HKTFdeOrszoOjWjEzwmh+tca3AFMu/nB++/KAmi5UJV7zsZ7uYJ5jm97LV5SLjN JIXXM+lHqCDrjDaDhNczmq1LCRlU6/WDjvkuwaVhZG4lXxMDrvKnXMkjseQ2oKjw rIdfQM86H1z5J31lfhqop+of0cimcIsBgSCPu+h96LHuAzeRBCbDKeqrfZtAZAGs okRina9947fRWxXHh3O66ILmXKNRxxWbDkPvYnQWUat8SbSTDoPWrDIGDRIAypqY o3pcN2OE0C1chqgDZQxkr+9kYZQpupOAN2TR+fM7JvbO9coKI8Uqog8CopoMeDQk d0YjcqlB1E0svODHTzcSoRzogDBYDqNLP7qVkNXpcOAXSVioBgiSDf7o5RdS/qmU yXBIeq6I5z8xBcd+BQ/n/9Frkm6K7IKP3ngUP4wEoiPx5ZE5+fPIScGmVUcZIMhk vMvem9XXh1yyhqN14gfjmLwPGdWbrgG8QUe0s2WeWIyss6uTiyF+ZbJSo2XOKVc3 YFMVUUfgyudqAV1wWdZinUk+H3pkqOKoHAy/8fST =3DYzQY -----END PGP PUBLIC KEY BLOCK----- --------------AE307C5FD6447DD7C6091370-- --bntmW1S6IzLLC5KpJn1iWj2yxIAcb48MF-- --88DgKbyE7wCFzhqkL5zw7FJtZndnZWxWS Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEW7Wm6ldl0sWGPK4nWrL68XsXK+oFAl0LQcoACgkQWrL68XsX K+o+FBAAjYJf8FcINrkIwzIbnwr0X88Mp3eKA3yS+y1F4euG7hh+VnsjK8AsPgHP E7fbA8Q1mGTHtfEUxEDQzZQoLsZUgkXkRSBM0wOz0acqmecGklvNqpekgfvu7K2T ILOHfTPUsBxa5kyNKHvQ15d+SPb18pHoYWsshC1FwCbXm3SF0nn5lJCJeCTuxrVX s+Ng2E+1xbVX93utsTgGli+siYU2dJ2OgvBp2kp4uDAIleNGZIE6IQkmdkudVETn t5wb5IEZk9J2nc59gB2rZNtsgHwbJ/NpIIjl/sOR6KGdAz48QQiAje4jeat2TgkP tDfdTyEUdO+v/l9ZwiwzsSqfpPyuDuDZvxb6W/EDkb8p2w2hN3UdNWoBVJifRj3j O1zK59+F2VhFImbYhNzj9cbkL6ebhisTQ0amfROee1onXb2BiV6Ffbph5WlQXGS5 mTGUePp2oxX/3p08qDO3KEGA0kwezEhHmo3lW6jtonrCP9QlD/JORWQ5niCjW16t LsB7ceaY9Dwfpo/jkCpCqvrYH92tLekbWZ9py0nMy9feicK6r+WWvn7TqIv/x5O5 O7VJGN4W11r20hDAhLCQcF2m7ehH28jFP1et+7Q1V7GN3QgxtR8J92KXVu2m9/FI 2v/GbtFZK/s6y1uJ/bpotzPqdFt8HclUbJf+RvJZMlPuCqU14vM= =8qtb -----END PGP SIGNATURE----- --88DgKbyE7wCFzhqkL5zw7FJtZndnZWxWS-- From nobody Thu Jun 20 04:21:07 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1631712003F for ; Thu, 20 Jun 2019 04:21:06 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.509 X-Spam-Level: X-Spam-Status: No, score=-17.509 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_DKIMWL_WL_MED=-0.01, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0AlMueptEaIu for ; Thu, 20 Jun 2019 04:21:02 -0700 (PDT) Received: from mail-ua1-x92e.google.com (mail-ua1-x92e.google.com [IPv6:2607:f8b0:4864:20::92e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5099D12002F for ; Thu, 20 Jun 2019 04:21:02 -0700 (PDT) Received: by mail-ua1-x92e.google.com with SMTP id v18so1444927uad.12 for ; Thu, 20 Jun 2019 04:21:02 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=/zAIZAfCHAa3h1EIgGHSpb/HM8mOuxdk5I4577guMXU=; b=rrQfwxGkEKkVM7hk+uMJd8QGI8Q6lwqgSfaDsrKoz00hmCGW9uf0vm/oAA7YYZH2JT h2UpjR14TfH971MTTAdgYu1UZz+KtEPpA3JQQNnOylZ1XfbRGKVmBezJQEN/m0u2ej2D +mhlSNn0XlB5imZCqjx1/FWBmsliCGR+Pw+aqqMRlBDmZ/3vi2UxG6vE3KTtZ2y6cD/m aCeTFvHhSIaB4r3u2wiqMy6wSlV1EiHa+9Oblj7r5VFx5nlKaF+5y1glIx4AP+MQHmWB K9EU0cD1yFhzTRKQL9qLm8Tdj+qMXGZjk1T6gwyTofU1z5vJpv1fOxHtnt/l7BiTDF/U kprg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=/zAIZAfCHAa3h1EIgGHSpb/HM8mOuxdk5I4577guMXU=; b=Q2S/W7C77RvAZ3VGT8guoSvkPKciUA8IdEvCUbrNdljUNQgGJwENTvxq4gof24fZP4 Ucpn23P9lr84zhpq4lygf/Z14/qtH1V46IsbhMVMjBBImdBIdnQ7LToSHisW6pmaMhu6 QfBlHXh26tsdR4Q3eCBYWr2tmkMX1DIA80kuhkn98TLUoDLO2Zdw+y1jd9/1jmZ3Jqmx 6sD0a0DmeYIDiq4nD+cdyGrFgRc0Xs3oKZ2MuhEcb1w0SjNjLqxDh6lhJv9Qkr300lqq 03SwfGVyK2KQfMER5qPxC0Z1B0sv7rH00aXm0OcDjaMIbfgqb4ZOwjPvoHSMiaLwf/Ol 6Sfg== X-Gm-Message-State: APjAAAVeiOo8n/i56eNW8WofdWkkuqeWPvBwfEO4PqVxmSuokuO/2YOa 7107mJAQWAzecPChgUDyZDFoMBT9Qlp/Q9XobKnvDLQehOs= X-Google-Smtp-Source: APXvYqyliXjMiDlDKQgTwzniwPhmJ5neQUAouAo+s/ptamHzpT+BxxqRYvfVpukuI+4N4eKnkPNlpHHdH+ouJLjtp1Q= X-Received: by 2002:a9f:31a2:: with SMTP id v31mr17315158uad.15.1561029660896; Thu, 20 Jun 2019 04:21:00 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Ben Schwartz Date: Thu, 20 Jun 2019 07:20:48 -0400 Message-ID: To: Stephen Farrell Cc: "tls@ietf.org" Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha-256; boundary="000000000000764311058bbf8a68" Archived-At: Subject: Re: [TLS] ESNI and padding X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 20 Jun 2019 11:21:06 -0000 --000000000000764311058bbf8a68 Content-Type: multipart/alternative; boundary="0000000000006c6a17058bbf8ae6" --0000000000006c6a17058bbf8ae6 Content-Type: text/plain; charset="UTF-8" On Wed, Jun 19, 2019 at 6:34 PM Stephen Farrell wrote: ... > What I'd suggest instead: > > - delete the padded_length field from ESNIKeys, so nobody needs > to configure anything for padding > - clients MUST pad to a multiple of N octets where N is in the > spec (I'd suggest N=32, but any number that's longer than > nearly all real TLS server names would be good) > - we RECOMMEND clients randomly add an additional N octets of > padding with probability X%, perhaps with X=10 (btw - am I > right in thinking that if X% is greater than the percentage > of real names that are longer than N, then we're good?) > - we STRONGLY RECOMMEND that servers choose names shorter than > N octets for hidden web sites As you are clearly aware, this approach provides essentially no privacy protection in the case where a user is repeatedly connecting to a very long domain on a server whose other domains are reasonably short. Rather than make a privacy-vs-efficiency tradeoff in the spec, the current text leaves this option to the implementer. For example, within the current protocol (albeit bending the recommendations slightly), an implementer could easily bucket names by length, and offer separate ESNIKeys for each length bucket. I think this is preferable; only the server operator knows their own privacy and efficiency goals. In my view, setting N=32 for the first bucket would reproduce most of the benefits of this proposal without altering the current protocol. --0000000000006c6a17058bbf8ae6 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Wed, Jun 19, 2019 at 6:34 PM Stephen F= arrell <stephen.farrell@cs.= tcd.ie> wrote:
...
What I'd suggest instead:

- delete the padded_length field from ESNIKeys, so nobody needs
=C2=A0 to configure anything for padding
- clients MUST pad to a multiple of N octets where N is in the
=C2=A0 spec (I'd suggest N=3D32, but any number that's longer than<= br> =C2=A0 nearly all real TLS server names would be good)
- we RECOMMEND clients randomly add an additional N octets of
=C2=A0 padding with probability X%, perhaps with X=3D10 (btw - am I
=C2=A0 right in thinking that if X% is greater than the percentage
=C2=A0 of real names that are longer than N, then we're good?)
- we STRONGLY RECOMMEND that servers choose names shorter than
=C2=A0 N octets for hidden web sites

As you= are clearly aware, this approach provides essentially no privacy protectio= n in the case where a user is repeatedly connecting to a very long domain o= n a server whose other domains are reasonably short.

Rather than make a privacy-vs-efficiency tradeoff in the spec, the curre= nt text leaves this option to the implementer.=C2=A0 For example, within th= e current protocol (albeit bending the recommendations slightly), an implem= enter could easily bucket names by length, and offer separate ESNIKeys for = each length bucket.=C2=A0 I think this is preferable; only the server opera= tor knows their own privacy and efficiency goals.=C2=A0 In my view, setting= N=3D32 for the first bucket would reproduce most of the benefits of this p= roposal without altering the current protocol.
--0000000000006c6a17058bbf8ae6-- --000000000000764311058bbf8a68 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIIS5wYJKoZIhvcNAQcCoIIS2DCCEtQCAQExDzANBglghkgBZQMEAgEFADALBgkqhkiG9w0BBwGg ghBNMIIEXDCCA0SgAwIBAgIOSBtqDm4P/739RPqw/wcwDQYJKoZIhvcNAQELBQAwZDELMAkGA1UE BhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExOjA4BgNVBAMTMUdsb2JhbFNpZ24gUGVy c29uYWxTaWduIFBhcnRuZXJzIENBIC0gU0hBMjU2IC0gRzIwHhcNMTYwNjE1MDAwMDAwWhcNMjEw NjE1MDAwMDAwWjBMMQswCQYDVQQGEwJCRTEZMBcGA1UEChMQR2xvYmFsU2lnbiBudi1zYTEiMCAG A1UEAxMZR2xvYmFsU2lnbiBIViBTL01JTUUgQ0EgMTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC AQoCggEBALR23lKtjlZW/17kthzYcMHHKFgywfc4vLIjfq42NmMWbXkNUabIgS8KX4PnIFsTlD6F GO2fqnsTygvYPFBSMX4OCFtJXoikP2CQlEvO7WooyE94tqmqD+w0YtyP2IB5j4KvOIeNv1Gbnnes BIUWLFxs1ERvYDhmk+OrvW7Vd8ZfpRJj71Rb+QQsUpkyTySaqALXnyztTDp1L5d1bABJN/bJbEU3 Hf5FLrANmognIu+Npty6GrA6p3yKELzTsilOFmYNWg7L838NS2JbFOndl+ce89gM36CW7vyhszi6 6LqqzJL8MsmkP53GGhf11YMP9EkmawYouMDP/PwQYhIiUO0CAwEAAaOCASIwggEeMA4GA1UdDwEB /wQEAwIBBjAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwQwEgYDVR0TAQH/BAgwBgEB/wIB ADAdBgNVHQ4EFgQUyzgSsMeZwHiSjLMhleb0JmLA4D8wHwYDVR0jBBgwFoAUJiSSix/TRK+xsBtt r+500ox4AAMwSwYDVR0fBEQwQjBAoD6gPIY6aHR0cDovL2NybC5nbG9iYWxzaWduLmNvbS9ncy9n c3BlcnNvbmFsc2lnbnB0bnJzc2hhMmcyLmNybDBMBgNVHSAERTBDMEEGCSsGAQQBoDIBKDA0MDIG CCsGAQUFBwIBFiZodHRwczovL3d3dy5nbG9iYWxzaWduLmNvbS9yZXBvc2l0b3J5LzANBgkqhkiG 9w0BAQsFAAOCAQEACskdySGYIOi63wgeTmljjA5BHHN9uLuAMHotXgbYeGVrz7+DkFNgWRQ/dNse Qa4e+FeHWq2fu73SamhAQyLigNKZF7ZzHPUkSpSTjQqVzbyDaFHtRBAwuACuymaOWOWPePZXOH9x t4HPwRQuur57RKiEm1F6/YJVQ5UTkzAyPoeND/y1GzXS4kjhVuoOQX3GfXDZdwoN8jMYBZTO0H5h isymlIl6aot0E5KIKqosW6mhupdkS1ZZPp4WXR4frybSkLejjmkTYCTUmh9DuvKEQ1Ge7siwsWgA NS1Ln+uvIuObpbNaeAyMZY0U5R/OyIDaq+m9KXPYvrCZ0TCLbcKuRzCCBB4wggMGoAMCAQICCwQA AAAAATGJxkCyMA0GCSqGSIb3DQEBCwUAMEwxIDAeBgNVBAsTF0dsb2JhbFNpZ24gUm9vdCBDQSAt IFIzMRMwEQYDVQQKEwpHbG9iYWxTaWduMRMwEQYDVQQDEwpHbG9iYWxTaWduMB4XDTExMDgwMjEw MDAwMFoXDTI5MDMyOTEwMDAwMFowZDELMAkGA1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24g bnYtc2ExOjA4BgNVBAMTMUdsb2JhbFNpZ24gUGVyc29uYWxTaWduIFBhcnRuZXJzIENBIC0gU0hB MjU2IC0gRzIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCg/hRKosYAGP+P7mIdq5NB Kr3J0tg+8lPATlgp+F6W9CeIvnXRGUvdniO+BQnKxnX6RsC3AnE0hUUKRaM9/RDDWldYw35K+sge C8fWXvIbcYLXxWkXz+Hbxh0GXG61Evqux6i2sKeKvMr4s9BaN09cqJ/wF6KuP9jSyWcyY+IgL6u2 52my5UzYhnbf7D7IcC372bfhwM92n6r5hJx3r++rQEMHXlp/G9J3fftgsD1bzS7J/uHMFpr4MXua eoiMLV5gdmo0sQg23j4pihyFlAkkHHn4usPJ3EePw7ewQT6BUTFyvmEB+KDoi7T4RCAZDstgfpzD rR/TNwrK8/FXoqnFAgMBAAGjgegwgeUwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8C AQEwHQYDVR0OBBYEFCYkkosf00SvsbAbba/udNKMeAADMEcGA1UdIARAMD4wPAYEVR0gADA0MDIG CCsGAQUFBwIBFiZodHRwczovL3d3dy5nbG9iYWxzaWduLmNvbS9yZXBvc2l0b3J5LzA2BgNVHR8E LzAtMCugKaAnhiVodHRwOi8vY3JsLmdsb2JhbHNpZ24ubmV0L3Jvb3QtcjMuY3JsMB8GA1UdIwQY MBaAFI/wS3+oLkUkrk1Q+mOai97i3Ru8MA0GCSqGSIb3DQEBCwUAA4IBAQACAFVjHihZCV/IqJYt 7Nig/xek+9g0dmv1oQNGYI1WWeqHcMAV1h7cheKNr4EOANNvJWtAkoQz+076Sqnq0Puxwymj0/+e oQJ8GRODG9pxlSn3kysh7f+kotX7pYX5moUa0xq3TCjjYsF3G17E27qvn8SJwDsgEImnhXVT5vb7 qBYKadFizPzKPmwsJQDPKX58XmPxMcZ1tG77xCQEXrtABhYC3NBhu8+c5UoinLpBQC1iBnNpNwXT Lmd4nQdf9HCijG1e8myt78VP+QSwsaDT7LVcLT2oDPVggjhVcwljw3ePDwfGP9kNrR+lc8XrfClk WbrdhC2o4Ui28dtIVHd3MIIDXzCCAkegAwIBAgILBAAAAAABIVhTCKIwDQYJKoZIhvcNAQELBQAw TDEgMB4GA1UECxMXR2xvYmFsU2lnbiBSb290IENBIC0gUjMxEzARBgNVBAoTCkdsb2JhbFNpZ24x EzARBgNVBAMTCkdsb2JhbFNpZ24wHhcNMDkwMzE4MTAwMDAwWhcNMjkwMzE4MTAwMDAwWjBMMSAw HgYDVQQLExdHbG9iYWxTaWduIFJvb3QgQ0EgLSBSMzETMBEGA1UEChMKR2xvYmFsU2lnbjETMBEG A1UEAxMKR2xvYmFsU2lnbjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMwldpB5Bngi FvXAg7aEyiie/QV2EcWtiHL8RgJDx7KKnQRfJMsuS+FggkbhUqsMgUdwbN1k0ev1LKMPgj0MK66X 17YUhhB5uzsTgHeMCOFJ0mpiLx9e+pZo34knlTifBtc+ycsmWQ1z3rDI6SYOgxXG71uL0gRgykmm KPZpO/bLyCiR5Z2KYVc3rHQU3HTgOu5yLy6c+9C7v/U9AOEGM+iCK65TpjoWc4zdQQ4gOsC0p6Hp sk+QLjJg6VfLuQSSaGjlOCZgdbKfd/+RFO+uIEn8rUAVSNECMWEZXriX7613t2Saer9fwRPvm2L7 DWzgVGkWqQPabumDk3F2xmmFghcCAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQF MAMBAf8wHQYDVR0OBBYEFI/wS3+oLkUkrk1Q+mOai97i3Ru8MA0GCSqGSIb3DQEBCwUAA4IBAQBL QNvAUKr+yAzv95ZURUm7lgAJQayzE4aGKAczymvmdLm6AC2upArT9fHxD4q/c2dKg8dEe3jgr25s bwMpjjM5RcOO5LlXbKr8EpbsU8Yt5CRsuZRj+9xTaGdWPoO4zzUhw8lo/s7awlOqzJCK6fBdRoyV 3XpYKBovHd7NADdBj+1EbddTKJd+82cEHhXXipa0095MJ6RMG3NzdvQXmcIfeg7jLQitChws/zyr VQ4PkX4268NXSb7hLi18YIvDQVETI53O9zJrlAGomecsMx86OyXShkDOOyyGeMlhLxS67ttVb9+E 7gUJTb0o2HLO02JQZR7rkpeDMdmztcpHWD9fMIIEZDCCA0ygAwIBAgIMB/CJK1MgpV83jiIZMA0G CSqGSIb3DQEBCwUAMEwxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9iYWxTaWduIG52LXNhMSIw IAYDVQQDExlHbG9iYWxTaWduIEhWIFMvTUlNRSBDQSAxMB4XDTE5MDMxMzA4MjIxOVoXDTE5MDkw OTA4MjIxOVowIjEgMB4GCSqGSIb3DQEJAQwRYmVtYXNjQGdvb2dsZS5jb20wggEiMA0GCSqGSIb3 DQEBAQUAA4IBDwAwggEKAoIBAQCsphkGEsCh0fF4+6Wsi1u40JxI6W6Izew+dLGK4b93LCRAuJ8y g9wSnwGAtk9/23VmtKwBrMaJD5j9SVZpscvLAjrWwADl/THU22uTW0MsUE2fPOPv2s4hE+vMgRmK P2E+xpI6n0gFvn8qrUHO1dm6PJaP5SWa+zdB/Ja1LgMJTpevQqjK4LKjWmHFPR6CplS4RImjGk7U 0I6invTyQnL5p583t5PI7FcM5UyjAqxGEETdAuc7N4IqjNETvPwL0wLIzxPDA5PMqcWPSzg7sBAB LVUQRYNIAJPlVpUdg1IeAjil5BaaWBjEeCLBSGDFX3WaWfMNzQvRZr4i6oJxzV+1AgMBAAGjggFu MIIBajAcBgNVHREEFTATgRFiZW1hc2NAZ29vZ2xlLmNvbTBQBggrBgEFBQcBAQREMEIwQAYIKwYB BQUHMAKGNGh0dHA6Ly9zZWN1cmUuZ2xvYmFsc2lnbi5jb20vY2FjZXJ0L2dzaHZzbWltZWNhMS5j cnQwHQYDVR0OBBYEFFSy8ovdLNSQc8aqxOgKS7sBOm/UMB8GA1UdIwQYMBaAFMs4ErDHmcB4koyz IZXm9CZiwOA/MEwGA1UdIARFMEMwQQYJKwYBBAGgMgEoMDQwMgYIKwYBBQUHAgEWJmh0dHBzOi8v d3d3Lmdsb2JhbHNpZ24uY29tL3JlcG9zaXRvcnkvMDsGA1UdHwQ0MDIwMKAuoCyGKmh0dHA6Ly9j cmwuZ2xvYmFsc2lnbi5jb20vZ3NodnNtaW1lY2ExLmNybDAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0l BBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMEMA0GCSqGSIb3DQEBCwUAA4IBAQCbQ++Znz6xh85ZlZEN Y/vAF0vn111O0c2houe4LlLQkoQ1QS4fH5EYcBx/393FTq5n08ezWYVtmeQ6W15e34CqjYNop1Vh mihZ+3J6+LL/6YNi91cp5yMFgxOP9aI/Y8IaIWZJAY2e8yHbYSq0z8kka0H6S4VvFjwtRogkWW95 0SStEwo/8viJ02BwpmVj4YIA6Fva1ZbeN2TnUMCAHJAlKWOGlpHxpcdcWckED0XbSY9w6bllMw1T tsbiUwQxDeO++Y8NfS8rieZgfv3RlobKihE8xbIVGRHIq1gup4nXv6XDwHDYyGhafIfUD4Ix00Wk gnODGb+jPwoQlDX0X64qMYICXjCCAloCAQEwXDBMMQswCQYDVQQGEwJCRTEZMBcGA1UEChMQR2xv YmFsU2lnbiBudi1zYTEiMCAGA1UEAxMZR2xvYmFsU2lnbiBIViBTL01JTUUgQ0EgMQIMB/CJK1Mg pV83jiIZMA0GCWCGSAFlAwQCAQUAoIHUMC8GCSqGSIb3DQEJBDEiBCBNcald3Fj3UzaWAA1sei/R AFFi5eCT+0m3JxvuuI5BEDAYBgkqhkiG9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEP Fw0xOTA2MjAxMTIxMDFaMGkGCSqGSIb3DQEJDzFcMFowCwYJYIZIAWUDBAEqMAsGCWCGSAFlAwQB FjALBglghkgBZQMEAQIwCgYIKoZIhvcNAwcwCwYJKoZIhvcNAQEKMAsGCSqGSIb3DQEBBzALBglg hkgBZQMEAgEwDQYJKoZIhvcNAQEBBQAEggEAD14S3NilD3hAHNXUHlYN24E5ruKZDhMkbGzH6RHl khF0Xtq5GDmNfPySfPXCuoYeQsDKhkOOcjm5BNCA+FwyHF6juF9ztaiXYw6h5ueMOS5/g/ucHlcQ nbMbUBZG5ptnzeqhgRCpJrRpqyLfEtoyBmUMAGjAdpbbaxougiz4Iw6pSkW6MQXeGGUobHJ8MPGK MEDViN8GqiwAdiTvnhh0vmSvJ4C+6giJ6IEULme+hlqq0T8vH5Cu8O/OvSSEctHeuRR56zjauJxO oP/aXGvZUzPLxAFewfkZMoAj7cw7FKCZYYsRUEBxWrnZwBPbODUz0fE0xSQ3Sp/cSdcEOympSg== --000000000000764311058bbf8a68-- From nobody Thu Jun 20 05:04:27 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9DF7412009C for ; Thu, 20 Jun 2019 05:04:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.3 X-Spam-Level: X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8Uy4nY_bB9sE for ; Thu, 20 Jun 2019 05:04:23 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1E2E812002F for ; Thu, 20 Jun 2019 05:04:23 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id 17B5CBEAA; Thu, 20 Jun 2019 13:04:20 +0100 (IST) Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vaFdpFGi35UD; Thu, 20 Jun 2019 13:04:19 +0100 (IST) Received: from [134.226.36.93] (unknown [134.226.36.93]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id C8C34BE8A; Thu, 20 Jun 2019 13:04:19 +0100 (IST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1561032259; bh=raiv/4opujkaRpKos1qaI845mfxzkCykxPGb/foFP0M=; h=To:Cc:References:From:Subject:Date:In-Reply-To:From; b=BwDFfkZIMymItlptno+igTCfDRc4oRRmFQWs+ee198WoFbSkP91/IKmDMpiLxo17K Gru0pGs2fOWe7cEWO1tdoaRbubB91Ut2GHsQgsB9atm6DRCGZYXB4W6ID5xNIj4iwq a9ZrFQTEC+Gh6NDjADuVTf3cykTSi7pDmEFDIC7w= To: Ben Schwartz Cc: "tls@ietf.org" References: From: Stephen Farrell Openpgp: id=5BB5A6EA5765D2C5863CAE275AB2FAF17B172BEA; url= Autocrypt: addr=stephen.farrell@cs.tcd.ie; prefer-encrypt=mutual; keydata= mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nemCP5PMvmh 5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kTq0IqYzsEv5HI58S+ QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtEgvw4fVhVWJuyy3w//0F2tzKr EMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy+pAh4EKzS1FE7BOZp9daMu9MUQmDqtZU bUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqO Vz+7L+WiVfxLbeVqBwV+4uL9to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJg b097ZaNyuY1ETghVB5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k 4LyM2lp5FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9tlyWxn5Xi HzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQABtDJTdGVwaGVuIEZh cnJlbGwgKDIwMTcpIDxzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPokCQAQTAQgAKgIbAwUJ CZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAUCWj6jdwIZAQAKCRBasvrxexcr6o7QD/9m x9DPJetmW794RXmNTrbTJ44zc/tJbcLdRBh0KBn9OW/EaAqjDmgNJeCMyJTKr1ywaps8HGUN hLEVkc14NUpgi4/Zkrbi3DmTp25OHj6wXBS5qVMyVynTMEIjOfeFFyxG+48od+Xn7qg6LT7G rHeNf+z/r0v9+8eZ1Ip63kshQDGhhpmRMKu4Ws9ZvTW2ACXkkTFaSGYJj3yIP4R6IgwBYGMz DXFX6nS4LA1s3pcPNxOgrvCyb60AiJZTLcOk/rRrpZtXB1XQc23ZZmrlTkl2HaThL6w3YKdi Ti1NbuMeOxZqtXcUshII45sANm4HuWNTiRh93Bn5bN6ddjgsaXEZBKUBuUaPBl7gQiQJcAlS 3MmGgVS4ZoX8+VaPGpXdQVFyBMRFlOKOC5XJESt7wY0RE2C8PFm+5eywSO/P1fkl9whkMgml 3OEuIQiP2ehRt/HVLMHkoM9CPQ7t6UwdrXrvX+vBZykav8x9U9M6KTgfsXytxUl6Vx5lPMLi 2/Jrsz6Mzh/IVZa3xjhq1OLFSI/tT2ji4FkJDQbO+yYUDhcuqfakDmtWLMxecZsY6O58A/95 8Qni6Xeq+Nh7zJ7wNcQOMoDGj+24di2TX1cKLzdDMWFaWzlNP5dB5VMwS9Wqj1Z6TzKjGjru q8soqohwb2CK9B3wzFg0Bs1iBI+2RuFnxLkCDQRaPVAyARAA+g3R0HzGr/Dl34Y07XqGqzq5 SU0nXIu9u8Ynsxj7gR5qb3HgUWYEWrHW2jHOByXnvkffucf5yzwrsvw8Q8iI8CFHiTYHPpey 4yPVn6R0w/FOMcY70eTIu/k6EEFDlDbs09DtKcrsT9bmN0XoRxITlXwWTufYqUnmS+YkAuk+ TLCtUin7OdaS2uU6Ata3PLQSeM2ZsUQMmYmHPwB9rmf+q2I005AJ9Q1SPQ2KNg/8xOGxo13S VuaSqYRQdpV93RuCOzg4vuXtR+gP0KQrus/P2ZCEPvU9cXF/2MIhXgOz207lv3iE2zGyNXld /n8spvWk+0bH5Zqd9Wcba/rGcBhmX9NKKDARZqjkv/zVEP1X97w1HsNYeUFNcg2lk9zQKb4v l1jx/Uz8ukzH2QNhU4R39dbF/4AwWuSVkGW6bTxHJqGs6YimbfdQqxTzmqFwz3JP0OtXX5q/ 6D4pHwcmJwEiDNzsBLl6skPSQ0Xyq3pua/qAP8MVm+YxCxJQITqZ8qjDLzoe7s9X6FLLC/DA L9kxl5saVSfDbuI3usH/emdtn0NA9/M7nfgih92zD92sl1yQXHT6BDa8xW1j+RU4P+E0wyd7 zgB2UeYgrp2IIcfG+xX2uFG5MJQ/nYfBoiALb0+dQHNHDtFnNGY3Oe8z1M9c5aDG3/s29QbJ +w7hEKKo9YMAEQEAAYkCJQQYAQgADwUCWj1QMgIbDAUJCZQmAAAKCRBasvrxexcr6qwvD/9b Rek3kfN8Q+jGrKl8qwY8HC5s4mhdDJZI/JP2FImf5J2+d5/e8UJ4fcsT79E0/FqX3Z9wZr6h sofPqLh1/YzDsYkZDHTYSGrlWGP/I5kXwUmFnBZHzM3WGrL3S7ZmCYMdudhykxXXjq7M6Do1 oxM8JofrXGtwBTLv5wfvvygJouVCVe87Ge7mCeY5vey1eUi4zSSF1zPpR6gg64w2g4TXM5qt SwkZVOv1g475LsGlYWRuJV8TA67yp1zJI7HkNqCo8KyHX0DPOh9c+Sd9ZX4aqKfqH9HIpnCL AYEgj7vofeix7gM3kQQmwynqq32bQGQBrKJEYp2vfeO30VsVx4dzuuiC5lyjUccVmw5D72J0 FlGrfEm0kw6D1qwyBg0SAMqamKN6XDdjhNAtXIaoA2UMZK/vZGGUKbqTgDdk0fnzOyb2zvXK CiPFKqIPAqKaDHg0JHdGI3KpQdRNLLzgx083EqEc6IAwWA6jSz+6lZDV6XDgF0lYqAYIkg3+ 6OUXUv6plMlwSHquiOc/MQXHfgUP5//Ra5JuiuyCj954FD+MBKIj8eWROfnzyEnBplVHGSDI ZLzL3pvV14dcsoajdeIH45i8DxnVm64BvEFHtLNlnliMrLOrk4shfmWyUqNlzilXN2BTFVFH 4MrnagFdcFnWYp1JPh96ZKjiqBwMv/H0kw== Message-ID: <65bae8fa-36b1-4724-4107-2e0e02a6adc6@cs.tcd.ie> Date: Thu, 20 Jun 2019 13:04:18 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.7.0 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="uNOZ3YCmLyK8cZPNspYcgh9W5c3m4Hmak" Archived-At: Subject: Re: [TLS] ESNI and padding X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 20 Jun 2019 12:04:26 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --uNOZ3YCmLyK8cZPNspYcgh9W5c3m4Hmak Content-Type: multipart/mixed; boundary="j7Fa7vZ3fQaXHpZ7r2t75Ee6FFUSkCG5a"; protected-headers="v1" From: Stephen Farrell To: Ben Schwartz Cc: "tls@ietf.org" Message-ID: <65bae8fa-36b1-4724-4107-2e0e02a6adc6@cs.tcd.ie> Subject: Re: [TLS] ESNI and padding References: In-Reply-To: --j7Fa7vZ3fQaXHpZ7r2t75Ee6FFUSkCG5a Content-Type: multipart/mixed; boundary="------------D862FF6A4F276067BA4B43E1" Content-Language: en-GB This is a multi-part message in MIME format. --------------D862FF6A4F276067BA4B43E1 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hiya, On 20/06/2019 12:20, Ben Schwartz wrote: >=20 > As you are clearly aware, this approach provides essentially no privacy= > protection in the case where a user is repeatedly connecting to a very = long > domain on a server whose other domains are reasonably short. Yep. I don't believe that that's at all a common scenario, but if I'm wrong then sure, the approach I outlined wouldn't be a good plan, at least not with N=3D32, but maybe some other N would work fine. Do we know how common very long SNI names are? (I don't.) If we think that scenario is a real problem, that can't be sufficiently mitigated via picking a good N, then I guess always having padding_length=3D=3D260 would be the only answer. In which case I see no upside and some downsides in having that field in ESNIkeys. > Rather than make a privacy-vs-efficiency tradeoff in the spec, the curr= ent > text leaves this option to the implementer. For example, within the > current protocol (albeit bending the recommendations slightly), an > implementer could easily bucket names by length, and offer separate > ESNIKeys for each length bucket. I think this is preferable; only the > server operator knows their own privacy and efficiency goals. In my vi= ew, > setting N=3D32 for the first bucket would reproduce most of the benefit= s of > this proposal without altering the current protocol. Fair point. OTOH, if you did that, the last (or maybe even all but the first) bucket would likely mean an ESNIKey used for very few names, so you end up with the same issue you called out above. And it adds some more complexity to what's an already complicated thing. So while that could always be done, and with the current spec, I'd not be keen to recommend it myself. I just looked back at RFC8467 which recommends padding DNS queries to a multiple of 128 octets. I also looked at a couple of DNS queries on my laptop just now and there seems to be about 40 octets overhead over and above the qname length (each "." adds two octets in the encoded length vs. the string length it seems). So one could I guess argue for some commensurate amount of padding in the ESNI extension and whatever was used for DoT or DoH. I wonder if the data DKG used to generate that recommendation in 8467 might tell us anything here? Again though, I think considering DNS query padding argues that this ought be a client-driven thing and not tied to the ESNIKeys. If no padding was used for DoT or DoH, the ESNI length may already have leaked regardless of the padded_length. That said, I'm not sure what, if any, padding is being done by DoT or DoH clients. (I use stubby and it does some padding sometimes but I'm not sure what.) Cheers, S. --------------D862FF6A4F276067BA4B43E1 Content-Type: application/pgp-keys; name="0x5AB2FAF17B172BEA.asc" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="0x5AB2FAF17B172BEA.asc" -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nem CP5PMvmh5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kT q0IqYzsEv5HI58S+QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtE gvw4fVhVWJuyy3w//0F2tzKrEMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy +pAh4EKzS1FE7BOZp9daMu9MUQmDqtZUbUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5 iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqOVz+7L+WiVfxLbeVqBwV+4uL9 to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJgb097ZaNyuY1ETghV B5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k4LyM2lp5 FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9t lyWxn5XiHzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQAB tCFTdGVwaGVuIEZhcnJlbGwgPHN0ZXBoZW5AamVsbC5pZT6JAj0EEwEIACcFAlo9 UYwCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQWrL68XsXK+qG CxAApYHWYgGOIL3G6/OpkejdAkQoCVQAK8LJUSf6vzwost4iVfxIKcKW/3RqKNKk rRl8beJ7j1CWXAz9+VXAOsE9+zNxXIDgGA7HlvJnhffl+qwibVgiHgUcJFhCSbBr sjC+1uULaTU8zYEyET//GOGPLF+X+degkE/sesh4zcEAjF7fGPnlncdCCH3tvPZZ sdTcjwOCRVonKsDgQzBTCMz/RPBfEFX44HZx4g1UQAcCA4xlucY8QkJEyCrSNGpG nvGK8DcGSmnstl1/a9fnlhpdFxieX3oY2phJ1WKkYTn6Advrek3UP71CKxpgtPmk d3iUUz/VZa0Cv6YxQXskspRDVEvdCMYSQBtJPQ4y2+5UxVR9GIQXenwYp9AP2niv Voh+ITsDWWeWnnvYMq07rSDjq0nGdj41MJkNX+Yb2PXVyXItcj5ybE3T2+y3pSBG FEZYJGuaL4NwtBJFMOdOtBmUOPbetS2971EL3Izxb7ibOZWDwexv+8R6SWYfP1wV N3p46RyBQuXqJV8ccE11m6vtZTGSYgnLUUFZMRQYH+0hwuYe0T3AA18xDdSYsa8v ovCCd3l5S4UNzIM2PMChqGrEzKapUpZg7+8ACcxRU3b9Ihd7WYjJ+pQPCoWYKozv tEvenbNpE/govO/ED3B14e+R2yevRPjRrsN7PJzSf15fQLuJARwEEAEIAAYFAlo9 UqAACgkQLzyHNoBfjaLrSwf+MIHbFRQ4O5cmLYR5sIByWelN3SuRN/gW8rpKo9Ok Cz6An8uV/iCXy5tNMLzzi0BFl8f22DwBcC5qy9qnlIAdogWam1qWoTAoAD8veEqm uKhYrqJsCcAyNrKYmK0hP3rpHxx1LySDmKYXmw/8qtBXKHTouMm+5tSsznhykRMT AAr2p7PSaHgo+hIVaW/rKSspHjDhhZS+G9mtOZad1IH29M6G1Q1NCO0Ywe8krKLQ IAQlFxtgvOqpPOZNzeKBa/+KbE8TGgMWrkOhC8OeEM5PVzdDhlhD9kPzB/pCKDF5 DofJ/ZRqnDpbKPQ0bsW38AOig3kOc0A27awiBEw3urqR1YkCMwQQAQgAHRYhBH4X CgRchM9GDit5oBDvedn9g1MSBQJbtyScAAoJEBDvedn9g1MSI/oP/0A9J9nrnBMq Zpm857lfYWw+rshLK+tyeP4OQeOqnDFvs9jePpcyJLG3DF2r6VbVKPQq+AE6Uf5h cJBDEN6BjEhRPSbLcqG3A1cz/nNwm8rPmNp+oKhmaBBQGxwciMLmzgynsDydnjPp MyEs04zvsbsl4vrp2095o105l8KcrrxQrioFjbwveGwHQK9bxJKhx9D+gIk+MouB ur45UDKTZkMZrr9FGrtkyXCGAxvKdcNC5Oa8z9sj1rcUJfG/OpVAMWhArdlZbFUQ yoX6pU2Zb1CR2qpWAVerGSfBhmfCyStjARqaKxlftjO+Bj3Jj73Cr5eqej3qB5+V 4BCsPjr4RLvVbYUCPsRdxWc+nBLlfVYkRURu21g1hFm5KFPjgUkyo1s4vjUOY8Dy I+xLGF7f/IhUBG6l+Vswhpwu7ydalZkeFiPx5xna5NfbEYxvsIf71DvipGvIOaHv X4egWoFgm8n/9c3rcMxJtpwHPSsUt5dgLsyu6VE0IbvOAc3dN7CWJ355DVFJq9Zg 2YVf0izSpyyzJeGsgkfjW6xpmdvZxuT2UcN4BTcm6vYqueASGrb3lfhzC5gpeVsc /MoSjTS65vNWbpzONZWMZuLEFraxWJzC0JrDK3NCd0VN3kstqGkVbUIiYOnUm8Vu 4zoVMLlGWzHLIGoPRG2nRezn1YyNfyb5iQGcBBABCgAGBQJbxcflAAoJEGo7ETk8 pK1gE7QL/ApC5P68W5DrI1787WJVZv1u4t/g39vTr7Xer3UMTVQg10vpa7pmqOGh jIDzDMg3Pe3K3M7fVzfAlUA1qw6ne4RCueVoRKpubeF4AlYbMr0K6hNCPjt5uAxm bBVuejKTc6pru5rv5gKL0nDbr+Snft5xt7juBLSSimw0/41sZnkjCxo9rF/RA/v6 +uWyK171RKmsEYu8fFtw1eqUNt/Xj792TUixE3pxXheNtQtZGk/9P3W83ChhG4Fh 5EQsn0pIh9wZIAbMRLpgRKyW87fWHZC8/YH8h7afarvn9Thl5pFUldCe22mNJj6K LChn2aEHQd+PdY1GBpZEcmNEUPuovwzatM0h64hCzTm41eDqRfihZVBT7TbfXQnv 8rywa42Mk756RGzzEZcQEhwQXZcMQUfxIQQ2VyJo0zG36VdZTQF7TF/4Lz7/3cJ5 6jOIm+dwPXtu+C2wAQuD4USOLt4JWPYpqzDfHYJIND/497P9Z9SuQeahr2ez3DRB g3qsHEjBV7QyU3RlcGhlbiBGYXJyZWxsICgyMDE3KSA8c3RlcGhlbi5mYXJyZWxs QGNzLnRjZC5pZT6JAkAEEwEIACoCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwEC HgECF4AFAlo+o3cCGQEACgkQWrL68XsXK+qO0A//ZsfQzyXrZlu/eEV5jU620yeO M3P7SW3C3UQYdCgZ/TlvxGgKow5oDSXgjMiUyq9csGqbPBxlDYSxFZHNeDVKYIuP 2ZK24tw5k6duTh4+sFwUualTMlcp0zBCIzn3hRcsRvuPKHfl5+6oOi0+xqx3jX/s /69L/fvHmdSKet5LIUAxoYaZkTCruFrPWb01tgAl5JExWkhmCY98iD+EeiIMAWBj Mw1xV+p0uCwNbN6XDzcToK7wsm+tAIiWUy3DpP60a6WbVwdV0HNt2WZq5U5Jdh2k 4S+sN2CnYk4tTW7jHjsWarV3FLISCOObADZuB7ljU4kYfdwZ+WzenXY4LGlxGQSl AblGjwZe4EIkCXAJUtzJhoFUuGaF/PlWjxqV3UFRcgTERZTijguVyREre8GNERNg vDxZvuXssEjvz9X5JfcIZDIJpdzhLiEIj9noUbfx1SzB5KDPQj0O7elMHa1671/r wWcpGr/MfVPTOik4H7F8rcVJelceZTzC4tvya7M+jM4fyFWWt8Y4atTixUiP7U9o 4uBZCQ0GzvsmFA4XLqn2pA5rVizMXnGbGOjufAP/efEJ4ul3qvjYe8ye8DXEDjKA xo/tuHYtk19XCi83QzFhWls5TT+XQeVTMEvVqo9Wek8yoxo67qvLKKqIcG9givQd 8MxYNAbNYgSPtkbhZ8SJARwEEAEIAAYFAlo9UqAACgkQLzyHNoBfjaLzHAgAlWT6 NXEGtw/r1miKNGcopzvzILQ9oB8rKI9U9EL6tOf/y2V5oYee/GyQDb3ZdoPxxYYc Jf+RyiH1nMoqUIZiZJaf3bJXinDZ5+AdfE++UR2NBvqaNyC6u3r24jo1B/sagKbY tWgsYtRqHLD4IWi37MZrVyjBuF7u14Q07+uhjq6mX2O/tHpCYw/Q82tbeTRPyUf1 WQOAfD1kfBpW9PvAva5Iw9FWeXpCXRzwxnCZhYfGfqtuSw6CPBYLdbikqML6FZ7E DuTBb/8um1wK7Y9bgeIQC+CYjhYB5RXa1tDJRab2Js4luCvSR0w/CgHw26293tlv e2Q6UTrmHxP5U22DlokCPQQTAQgAJwUCWj1QMgIbAwUJCZQmAAULCQgHAgYVCAkK CwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6tJpD/4rrILH+meP07vrx8wW5eYuqCiP GYnh/CXxIF8eLrfbe5d4QRgtq+w6UeQPMyzKRIRiCoBXB2oJLBZHyxBPxZlg33dT MrEGn8QWKx2iNuz9rZMXyOSWFetuO01d/aUPd5BnbLbIyK5of8xCQlXM6KH8bc+9 gQ7edR9mfLTdvBf2FR522hg8BRBM1imKc3vO8v39+qIHHRjuiwxBBCAOhHtHRsZX ripS0uFA07dM46Oi/E8osjx6fQt/lH5z/PN+2adxYSrLSAXfr1oD3RxYNhuWgyGF L64/VCQb1YGjf0Z5MBPnWm9jgUoOY5K9eNSS0L83WeJjlF5+Q/WOgB+rb49Prm2D Feo9+S9f2V53Llz1WIspXJg6f+n9lmHE94MfQj1GAHCzI0FeL19lvM+LhD8jJSCb hrC3+yobyy/AUOs5Z3E+njjX1FF/VCVAs6iOa6i+XG+Y1hh3ir2y1kckJ5auT10M SU8GEZu9ayU4M3o3N9yxOjaoP0NuQ4MMLL/n/u4u94AeZaHPNBXn/hVfVRRmpRXt GKvJtFAEppGEYezB+bLKIm6XlpPkhnwYzleLZ7AMEco2C6QM8QPB3g3JpS3sqRhA 5rEP4lL16BmijmF+CHoPE/zwgKZbKpyVDqvIW5IDgvfIC2X4pbZDRvGIUKaGSB4+ ksZgUUnNyvfQr2p7jokCMwQQAQgAHRYhBH4XCgRchM9GDit5oBDvedn9g1MSBQJb tySbAAoJEBDvedn9g1MSeKkQAJm44jt1kwHgQgeDBKdjdvl0AjE0xVEQxriZ6lP/ l//34YT0auFfzsYIrChSpQXAEtobBAr4Ohw1Us+BZe+H5P8vm6LRuPwozC3SjwfX 4Iec8+9ot6tIVg4sbedDSgb/CCFVjsmIGcQ1P73JLJTBJ6mxYCV/gn3QC6bwDOFo 7kD9FDHCjRN8XfhHQ4Q9cYyt06uF31qG/aumgWYC9geCGgAwiHgwxNYb9GoJ0iZj CROwbYvLTcQgsVUW2bTmsVR13UVKDsdl02sRV7qcVYW6R0a3Ra8KudX+nt25H5DR Gd382KZ5W8pydsy/viTvD9z6v0ulChBYxAedIvGIClrhbxlLEPmIg4ImVOLGqsUg Vm32J95WOjEkk4PEZ12xSDBtwhSJqmJNboWlfmw43KdIbY8zNhffIO3N6O7FsdGx mqyHeLoTpqY+ySVUPpbuyW8ujnI/J//+6hdTZ9dQsEJQlWngKuWOQ5ma58MPSN88 zllsqhZAFQjNxqnkSzL6ZQ+v/jvuRRe16B80AeO55DsmbWsMv/YLLD1mSi7+Khy2 EtMBhgojWwrGMvdLN6X3mnzNJEscYyLxM9tSk+iySP2sLthK0BVgpAzBSdaf/ezI z60P+neHDzteNFf8Mn7lmgYk1amvZoJ29s5+n2HwxyRL5dVMyMdyQmntubbctfqr Z0tIiQGcBBABCgAGBQJbxcflAAoJEGo7ETk8pK1gnCYMAJY4FeIYjlIXGghFWzsB 4fYwK1+iaFpU3fSto5qcrqVtVPjXpwqczqBWeXGyQxiB0kan4OVAXydIeaP8EAuF CA7paP3s9STLJBO3KurkwyRkPW5zo0X7xVqaVToRsX2Ul98KVJoHYQD1KdezEtwl vpNwiiBr42AYR751Vm6JBVAbQXuFpB3c8bUV0OkkRxNFtL8/2PieHar58n5dntGk bPlPkztahsFqktgacIgXHX5vaT+7YeeZ1DWLOYjGO0wNhkOSeroCmxwJUikU7joB p823L7r5KfpqWTPpSCzVstQKZUGmmoE1qCswY/Ud5wvp9SccpIILkRXj0rZRtfnE 5MpL3hjmtNzfDd9qIsJtBJlSB2hZwAsVm1l+EWN9hG3tqyA43niUMy2n6q690of3 berSiQ+kvY/aC9Hx8I+bKzOV9/J2VUTqfaPZa4Uy2rVX5Q2p69n/PMj7mEer0rCL 3j9V16J9c+s0BSkXoKdtYdB0TWVhBgUybd9qtYcwHWvhP7QuU3RlcGhlbiBGYXJy ZWxsIDxzdGVwaGVuQHRvbGVyYW50bmV0d29ya3MuY29tPokCPQQTAQgAJwUCWj1R WgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6jsc EADEcB0WQEZn2AkrzDs1RhL0Lp6cZi0BigofkbcGfdhJyMSs19C0dhvncrAFClVI 6/Udw3yFtDyYtOCf2W3M3A1K6/RfEizCLzTsdFIhni9gOJLlUpXViQtgrlstjk7h qVV3Ooz4BlCqS4cG7rfqf4LQQPpTAuFUEV9I28FBUB2irqC+v4gTysIgpMw0bA1y BU9sX5jE/tRkzqnuzZrkwiobDtRFJ9qp+7O2JtcY4EsVtLAsaodJKc5cF8R4OvB1 n66vxxcgg9Eh4JNWZ47xsaCmAGo1Bcb2jIY35OtgAL7gCGLRSMKTtAaPy1/fEgIq hCljJ9x40Fkn/3r2BX21WC9HFSPFTBz2RluLRzxdgxOrkYK8EiHUPoE5b1AEzZKw 2AbeXfr57f5zYsN3IqfbQLUjMYtUN1wK3Pjb+idD972wyXMWt8uOzlI7b9Ocu+nY m2whBfJv9Pmp3QYTmPz+LB9lH65VNVUSxSXVr5iWXO3qx1HtEiGEqkporMQCTh3T 5Ud3PvMSRBFFKNs9WhJ/Lxz+SV30WLwG6dr5mQqlzAhb4Phc/zekZyXRdS/oDKrB LUucS36O//49JeyRi1QvOfxnfmIqRIAf/k3PoYJmTo5E82//r5Qj3YGlRu78ba0H Arxs+ACD6AnEHHcbswpbtVEKYzlSu0Ar0Dc7vRWM/IyQdIkBHAQQAQgABgUCWj1S oAAKCRAvPIc2gF+NosIsB/9f/29FNla3BJfGIEIDnhrqGD0i9bSa89SqBd++uG06 TQgW5wsqtNcrwn81yZTq6XE6i9VtD4GKfqC0d4KZJr9bnbeD81cI64VOdL8zJWJs 0vj5EIXCobKyX74Kb4uePUyZqwT2Q74I116u/HwA9/FXsPo5isbh4ZqD4t0VHpWk mfq1FPT9a/JPyX46qKqB2Fce/7Qy+SQP1NfkuUlbhUH/JG9aSSYvk3lznNiH41x9 M+FDlL106itXOubrl3oi2fT3fsSedq7uzt+IV0DQEeNaoQAUuwEhdB8IWOMqN2wo DjGVKJftfsSWY9ilZrnDBNDrp0vRqcx33LUMkIw4d7iBiQIzBBABCAAdFiEEfhcK BFyEz0YOK3mgEO952f2DUxIFAlu3JJwACgkQEO952f2DUxJjuw/6ApHSsVTWD4a0 H6FJ23A9Ftpy+aXZ4vYlzkSrfsn2ECrEfK3lXQh/uzwjJUDYZeB1/BQsFZtcYNQO JSSHbQ49BFRLwb1J/wBZG4bbmrkLxnNbKDKQvzxEpclkMW0Dj0J6o7kGrmzIGGrh B+JJN99AcineHRug8ZSFIERRCmigxdhAKU0BFD7P+5HNHltSL3DF1c2fFOf2JrgB KVoE+9RhMZjWNbYetFFLCkjXb5Rpay9zeMm1DxfSTGAnuOwUXW6qq4hnl5+VC/48 ceDZElLLfu7RQUZv44pkSTOWZs+iQoJiHMFHk9wPqyB2Vok1yJ2a2j27WhXrJlPw nZbgJO5RyWDG3p/eVmpl5Uuc2dsfIpR17KnAuWpghK6V+cyFncDoGCl/YG2Mvool sW08FiZh3Ej4dnJjj25TZkeFG74JJDXLvMYpJfSBGnmETv4Dhcm2xPqVMuFuL1qJ lMbVLrMo2GXeo03OzNyvbs+u8WLIaGm5hC7N1CXY8wZs4jo6OJ/expvnc07dEuws 4zT3AiWv3nIouWReRStZy9QkavDocqbyPmilcdPCYk4BsOlzpwwO74hNG7iyl0Kd AlwTxGQ7y0rJou6HYa1TmRhIEr3vKvlW+JfUUrqtjXgsuacTXo4+Ira2JUErL2cY zQMq1j4r1ZyhFnuz93s7Rsx/Nw0+0YuJAZwEEAEKAAYFAlvFx+UACgkQajsROTyk rWCJqwv+NLVPE4sD4sDA2/6Ek7UsRIUkg+S39fhqWsLc4rtw/mDunv8Un61I3K04 fZ2Ry4nF9hZM0a710UvXFbStvrzRJO3EAAcdJR9LTCd19e8UeruQbIee3YT91U4N kC9JMpecfq62/teOAU2e5P3fWYaLs5ZX7zCLwWuBcW2l3SyoljQczM85HhJ3XHm+ FnwQ6D9xRle+lvWTcuC9d1yAyUb8IOospcL2lJTmy8e3r79R24hPlSB4LDe0wEN8 AXbagrcAQZjwyaHyWxjJbTwZ0b43WGdfIqZ1ElOeoffbketPGRmWvx5xUvb2ALFB BdETzV270gs5XDJgJ1SIIKOyDADxwvroTe2jD8C/841eEql5QSow3s/U3zRqk3mt tto8Qw/DN71aeh6dmYSsvd2UjsHw/vofOPRBGxZLEkKTEvMnhmMW9hiKPkPia+Qg evYE020qpKSxLEdWA8nprHwxmGiDNesCfXSC6vm1qfyj5g8HzxSckq9ZaMhKMCo7 vxflUEDuuQINBFo9UDIBEAD6DdHQfMav8OXfhjTteoarOrlJTSdci727xiezGPuB HmpvceBRZgRasdbaMc4HJee+R9+5x/nLPCuy/DxDyIjwIUeJNgc+l7LjI9WfpHTD 8U4xxjvR5Mi7+ToQQUOUNuzT0O0pyuxP1uY3RehHEhOVfBZO59ipSeZL5iQC6T5M sK1SKfs51pLa5ToC1rc8tBJ4zZmxRAyZiYc/AH2uZ/6rYjTTkAn1DVI9DYo2D/zE 4bGjXdJW5pKphFB2lX3dG4I7ODi+5e1H6A/QpCu6z8/ZkIQ+9T1xcX/YwiFeA7Pb TuW/eITbMbI1eV3+fyym9aT7Rsflmp31Zxtr+sZwGGZf00ooMBFmqOS//NUQ/Vf3 vDUew1h5QU1yDaWT3NApvi+XWPH9TPy6TMfZA2FThHf11sX/gDBa5JWQZbptPEcm oazpiKZt91CrFPOaoXDPck/Q61dfmr/oPikfByYnASIM3OwEuXqyQ9JDRfKrem5r +oA/wxWb5jELElAhOpnyqMMvOh7uz1foUssL8MAv2TGXmxpVJ8Nu4je6wf96Z22f Q0D38zud+CKH3bMP3ayXXJBcdPoENrzFbWP5FTg/4TTDJ3vOAHZR5iCunYghx8b7 Ffa4UbkwlD+dh8GiIAtvT51Ac0cO0Wc0Zjc57zPUz1zloMbf+zb1Bsn7DuEQoqj1 gwARAQABiQIlBBgBCAAPBQJaPVAyAhsMBQkJlCYAAAoJEFqy+vF7FyvqrC8P/1tF 6TeR83xD6MasqXyrBjwcLmziaF0Mlkj8k/YUiZ/knb53n97xQnh9yxPv0TT8Wpfd n3BmvqGyh8+ouHX9jMOxiRkMdNhIauVYY/8jmRfBSYWcFkfMzdYasvdLtmYJgx25 2HKTFdeOrszoOjWjEzwmh+tca3AFMu/nB++/KAmi5UJV7zsZ7uYJ5jm97LV5SLjN JIXXM+lHqCDrjDaDhNczmq1LCRlU6/WDjvkuwaVhZG4lXxMDrvKnXMkjseQ2oKjw rIdfQM86H1z5J31lfhqop+of0cimcIsBgSCPu+h96LHuAzeRBCbDKeqrfZtAZAGs okRina9947fRWxXHh3O66ILmXKNRxxWbDkPvYnQWUat8SbSTDoPWrDIGDRIAypqY o3pcN2OE0C1chqgDZQxkr+9kYZQpupOAN2TR+fM7JvbO9coKI8Uqog8CopoMeDQk d0YjcqlB1E0svODHTzcSoRzogDBYDqNLP7qVkNXpcOAXSVioBgiSDf7o5RdS/qmU yXBIeq6I5z8xBcd+BQ/n/9Frkm6K7IKP3ngUP4wEoiPx5ZE5+fPIScGmVUcZIMhk vMvem9XXh1yyhqN14gfjmLwPGdWbrgG8QUe0s2WeWIyss6uTiyF+ZbJSo2XOKVc3 YFMVUUfgyudqAV1wWdZinUk+H3pkqOKoHAy/8fST =3DYzQY -----END PGP PUBLIC KEY BLOCK----- --------------D862FF6A4F276067BA4B43E1-- --j7Fa7vZ3fQaXHpZ7r2t75Ee6FFUSkCG5a-- --uNOZ3YCmLyK8cZPNspYcgh9W5c3m4Hmak Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEW7Wm6ldl0sWGPK4nWrL68XsXK+oFAl0LdkIACgkQWrL68XsX K+qT0A/+MicEZfbOOQF1KzSoJwdYJsIuSnCi/JGvODwBJ2W924uG0pGLEyv+xFs9 /umFFKp0ipajvOrPJlQBD4JI9+i2KrPvtHu6lR3JB+1ezMD7T+T7Z+qbyA8sBKKc KYyAApsCvNRD94f/8Onx79BS51ZBoLxhq0cSZ0TzTOcV77JdByDy3f3c9xPiy5E+ e+slfI4ui4hRetXruKOVZehantNUdIohiY35qbcmo8hKwFVF6TCmCVfkcUqsSVNy Oy3UjUIEmtTeGFtrjRY5axaVoDcFMqgjqSmPZz+8X/qdz5snPDYYtAbgZvBuUd4h HEtyiTjlMGUBMXc3nW1YVXRDfHuN5eprI0X+EHWTzXYOw10WCJ5oPwnkOhf1qR8T q4eVkk02tIbFRiGycdjYxSeN6BNPqBv/aKomUWQaYmCxxXQt9KMcoRjBGWX43A0N BGLS6fpwL5l/yjIuPXYJ4kKlZSk78UizNxePVSr05XAFzKL92oZs3YaVbc/J3AWk 4t/vNvpr5Rib2RncofpxfkHWF8hWZSHtprUJP+rQWzmn9Z64yc5qc1g+DU5VtUne tp3Emb2dqCOgWvP+89o/Xi92JhKn91EpVMKOOlXRbnMgByawMoEyFcNw2AFDWie4 xNyEmBS26BbKjJUsU/331Li1ojrxgms0fLChOyGmWdAicCgZi24= =N6IK -----END PGP SIGNATURE----- --uNOZ3YCmLyK8cZPNspYcgh9W5c3m4Hmak-- From nobody Thu Jun 20 06:16:29 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EB308120045 for ; Thu, 20 Jun 2019 06:16:27 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.509 X-Spam-Level: X-Spam-Status: No, score=-17.509 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_DKIMWL_WL_MED=-0.01, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xjyELEc-8eVJ for ; Thu, 20 Jun 2019 06:16:25 -0700 (PDT) Received: from mail-ua1-x933.google.com (mail-ua1-x933.google.com [IPv6:2607:f8b0:4864:20::933]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2152C12000E for ; Thu, 20 Jun 2019 06:16:25 -0700 (PDT) Received: by mail-ua1-x933.google.com with SMTP id s4so1610002uad.7 for ; Thu, 20 Jun 2019 06:16:25 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=m8We00VKw0xpVJoZnRcMcpBJ4snuEicwp/V8gY9vBgA=; b=kCgSgCIhUjDVPX5vuPvdRokLbdsFrMvvZmtbavNvDkzoUkzCnS24Ufl3xkJJYwP+tS Ehxj8SuYMPOdA24DXQxtGy5cS5J54Buh9e9tkGnGJw63gpbIZ2nvdDuSXB3r5QjbMPtE XykkNQrI3rLNv1jT+cicwk0bVcS0kYRBHLBDT1qFG7xG3Zl7AyFhNBWhsyTi+zQCDddn 8SiqJZE1h03+BuI4DmSeIbyZt5RPi+uOBboeIK1RTqbjbw0Ha3AwwdO5cnFiaDQ98Yu/ zw250au4360ZFmtbdn6nFe9+dqKty/8ZLTxK/i+k9HqWsOPMJ8raPLrr9VpRERfFJgvh i+sA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=m8We00VKw0xpVJoZnRcMcpBJ4snuEicwp/V8gY9vBgA=; b=ui1daesNxOVlTm0AwZWAp0lmser9+i3S4uBivVGXTUCdQGEc46QGVode4/RguLaIMi MS3TBV2RU0Cn7g2PubHkQyfu38Sxc4exF29t0KuvPgIFqumdvTayBE6KkRtJPZDJtDU3 z4V96FZ1JJNXWqTCt7iUYDIF1qHs9VU/fpjjc5yHXeYzbe0I1Oox769DkL8lzAktmcdQ cuEqMiA4NZmTexAjvfkwQqQhJQJp9/TWpZNb+PyLeHRGABQ/R+453D8FF38LTF/90zfs qe6CRdH5cxcownhAOgPlx0NBqNKzEJeO16Wt5udkSmhIVCKIs0XoeNxwuV4rhGo35I61 uUYA== X-Gm-Message-State: APjAAAXxCSyFq/VemBN4iHvR4NJDH1gYNaDci6kqUfErNTVantpWxN1t srCq+tc7DzMm5uDTRurMLqlRaw4dPYgL2G6mmZj9bHbS7/s= X-Google-Smtp-Source: APXvYqz4WlzXV0BwYw4G/vqv2hCJK+iE+bEW6+WMVLwaMXf8101hEAaHymTVukAhcV7IDR9Fyd3B5ex4227NzmESS+0= X-Received: by 2002:a9f:2e0e:: with SMTP id t14mr25613541uaj.119.1561036583626; Thu, 20 Jun 2019 06:16:23 -0700 (PDT) MIME-Version: 1.0 References: <65bae8fa-36b1-4724-4107-2e0e02a6adc6@cs.tcd.ie> In-Reply-To: <65bae8fa-36b1-4724-4107-2e0e02a6adc6@cs.tcd.ie> From: Ben Schwartz Date: Thu, 20 Jun 2019 09:16:10 -0400 Message-ID: To: Stephen Farrell Cc: "tls@ietf.org" Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha-256; boundary="00000000000016de23058bc12714" Archived-At: Subject: Re: [TLS] ESNI and padding X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 20 Jun 2019 13:16:28 -0000 --00000000000016de23058bc12714 Content-Type: multipart/alternative; boundary="0000000000000cd07a058bc12742" --0000000000000cd07a058bc12742 Content-Type: text/plain; charset="UTF-8" On Thu, Jun 20, 2019 at 8:04 AM Stephen Farrell wrote: > > Hiya, > > On 20/06/2019 12:20, Ben Schwartz wrote: > > > > As you are clearly aware, this approach provides essentially no privacy > > protection in the case where a user is repeatedly connecting to a very > long > > domain on a server whose other domains are reasonably short. > > Yep. I don't believe that that's at all a common scenario, > but if I'm wrong then sure, the approach I outlined wouldn't > be a good plan, at least not with N=32, but maybe some other > N would work fine. Do we know how common very long SNI names > are? (I don't.) > > If we think that scenario is a real problem, that can't be > sufficiently mitigated via picking a good N, then I guess > always having padding_length==260 would be the only answer. > In which case I see no upside and some downsides in having > that field in ESNIkeys. > > > Rather than make a privacy-vs-efficiency tradeoff in the spec, the > current > > text leaves this option to the implementer. For example, within the > > current protocol (albeit bending the recommendations slightly), an > > implementer could easily bucket names by length, and offer separate > > ESNIKeys for each length bucket. I think this is preferable; only the > > server operator knows their own privacy and efficiency goals. In my > view, > > setting N=32 for the first bucket would reproduce most of the benefits of > > this proposal without altering the current protocol. > > Fair point. OTOH, if you did that, the last (or maybe even > all but the first) bucket would likely mean an ESNIKey used > for very few names, so you end up with the same issue you > called out above. And it adds some more complexity to what's > an already complicated thing. So while that could always > be done, and with the current spec, I'd not be keen to > recommend it myself. > > I just looked back at RFC8467 which recommends padding DNS > queries to a multiple of 128 octets. I also looked at a couple > of DNS queries on my laptop just now and there seems to be > about 40 octets overhead over and above the qname length > (each "." adds two octets in the encoded length vs. the > string length it seems). So one could I guess argue for some > commensurate amount of padding in the ESNI extension and > whatever was used for DoT or DoH. I wonder if the data DKG > used to generate that recommendation in 8467 might tell us > anything here? > I've implemented RFC 8467 myself, and I'm grateful for the recommendation, but I think it's rightly marked Experimental. It's not clear how to judge the amount of privacy protection it offers, or whether it's truly a good balance between privacy and efficiency. However, as a matter of overhead, your test suggests that RFC 8467 roughly doubles the size of each query packet. That's similar to the proportional effect of maximum ESNI padding on a typical ClientHello. Proportionally, I expect RFC 8467 adds more padding to the whole DNS transaction than current ESNI adds to the whole TLS handshake. It might even be true in absolute terms, on average. In the context of a full TLS connection, the proportional impact of ESNI is even smaller. Again though, I think considering DNS query padding argues > that this ought be a client-driven thing and not tied to the > ESNIKeys. One important difference between these cases is that DNS is essentially an "open world", where no one knows the whole space of possibilities, whereas a specific server is a "closed world", a finite set of domains (known only to the server operator). That puts the server operator in the unique position to make correct padding decisions, and also makes the adversary's job much easier if the padding is incorrect. If no padding was used for DoT or DoH, the ESNI > length may already have leaked regardless of the padded_length. > That said, I'm not sure what, if any, padding is being done > by DoT or DoH clients. (I use stubby and it does some padding > sometimes but I'm not sure what.) > In general, I think we should assume that no SNI information is leaking through other channels when making design choices for ESNI. Otherwise, we risk ESNI itself becoming the limiting factor in the future as those other leaks are fixed. > > Cheers, > S. > > > > > --0000000000000cd07a058bc12742 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Thu, Jun 20, 2019 at 8:04 AM Steph= en Farrell <stephen.farrell= @cs.tcd.ie> wrote:

Hiya,

On 20/06/2019 12:20, Ben Schwartz wrote:
>
> As you are clearly aware, this approach provides essentially no privac= y
> protection in the case where a user is repeatedly connecting to a very= long
> domain on a server whose other domains are reasonably short.

Yep. I don't believe that that's at all a common scenario,
but if I'm wrong then sure, the approach I outlined wouldn't
be a good plan, at least not with N=3D32, but maybe some other
N would work fine. Do we know how common very long SNI names
are? (I don't.)

If we think that scenario is a real problem, that can't be
sufficiently mitigated via picking a good N, then I guess
always having padding_length=3D=3D260 would be the only answer.
In which case I see no upside and some downsides in having
that field in ESNIkeys.

> Rather than make a privacy-vs-efficiency tradeoff in the spec, the cur= rent
> text leaves this option to the implementer.=C2=A0 For example, within = the
> current protocol (albeit bending the recommendations slightly), an
> implementer could easily bucket names by length, and offer separate > ESNIKeys for each length bucket.=C2=A0 I think this is preferable; onl= y the
> server operator knows their own privacy and efficiency goals.=C2=A0 In= my view,
> setting N=3D32 for the first bucket would reproduce most of the benefi= ts of
> this proposal without altering the current protocol.

Fair point. OTOH, if you did that, the last (or maybe even
all but the first) bucket would likely mean an ESNIKey used
for very few names, so you end up with the same issue you
called out above. And it adds some more complexity to what's
an already complicated thing. So while that could always
be done, and with the current spec, I'd not be keen to
recommend it myself.

I just looked back at RFC8467 which recommends padding DNS
queries to a multiple of 128 octets. I also looked at a couple
of DNS queries on my laptop just now and there seems to be
about 40 octets overhead over and above the qname length
(each "." adds two octets in the encoded length vs. the
string length it seems). So one could I guess argue for some
commensurate amount of padding in the ESNI extension and
whatever was used for DoT or DoH. I wonder if the data DKG
used to generate that recommendation in 8467 might tell us
anything here?

I've implemented RFC= 8467 myself, and I'm grateful for the recommendation, but I think it&#= 39;s rightly marked Experimental.=C2=A0 It's not clear how to judge the= amount of privacy protection it offers, or whether it's truly a good b= alance between privacy and efficiency.

However, as= a matter of overhead, your test suggests that RFC 8467 roughly doubles the= size of each query packet.=C2=A0 That's similar to the proportional ef= fect of maximum ESNI padding on a typical ClientHello.=C2=A0 Proportionally= , I expect RFC 8467 adds more padding to the whole DNS transaction than cur= rent ESNI adds to the whole TLS handshake.=C2=A0 It might even be true in a= bsolute terms, on average.=C2=A0 In the context of a full TLS connection, t= he proportional impact of ESNI is even smaller.

Again though, I think considering DNS query padding argues
that this ought be a client-driven thing and not tied to the
ESNIKeys.
=C2=A0
One important difference betwee= n these cases is that DNS is essentially an "open world", where n= o one knows the whole space of possibilities, whereas a specific server is = a "closed world", a finite set of domains (known only to the serv= er operator).=C2=A0 That puts the server operator in the unique position to= make correct padding decisions, and also makes the adversary's job muc= h easier if the padding is incorrect.

If no padding was used for DoT or DoH, th= e ESNI
length may already have leaked regardless of the padded_length.
That said, I'm not sure what, if any, padding is being done
by DoT or DoH clients. (I use stubby and it does some padding
sometimes but I'm not sure what.)

I= n general, I think we should assume that no SNI information is leaking thro= ugh other channels when making design choices for ESNI.=C2=A0 Otherwise, we= risk ESNI itself becoming the limiting factor in the future as those other= leaks are fixed.
=C2=A0

Cheers,
S.




--0000000000000cd07a058bc12742-- --00000000000016de23058bc12714 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIIS5wYJKoZIhvcNAQcCoIIS2DCCEtQCAQExDzANBglghkgBZQMEAgEFADALBgkqhkiG9w0BBwGg ghBNMIIEXDCCA0SgAwIBAgIOSBtqDm4P/739RPqw/wcwDQYJKoZIhvcNAQELBQAwZDELMAkGA1UE BhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExOjA4BgNVBAMTMUdsb2JhbFNpZ24gUGVy c29uYWxTaWduIFBhcnRuZXJzIENBIC0gU0hBMjU2IC0gRzIwHhcNMTYwNjE1MDAwMDAwWhcNMjEw NjE1MDAwMDAwWjBMMQswCQYDVQQGEwJCRTEZMBcGA1UEChMQR2xvYmFsU2lnbiBudi1zYTEiMCAG A1UEAxMZR2xvYmFsU2lnbiBIViBTL01JTUUgQ0EgMTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC AQoCggEBALR23lKtjlZW/17kthzYcMHHKFgywfc4vLIjfq42NmMWbXkNUabIgS8KX4PnIFsTlD6F GO2fqnsTygvYPFBSMX4OCFtJXoikP2CQlEvO7WooyE94tqmqD+w0YtyP2IB5j4KvOIeNv1Gbnnes BIUWLFxs1ERvYDhmk+OrvW7Vd8ZfpRJj71Rb+QQsUpkyTySaqALXnyztTDp1L5d1bABJN/bJbEU3 Hf5FLrANmognIu+Npty6GrA6p3yKELzTsilOFmYNWg7L838NS2JbFOndl+ce89gM36CW7vyhszi6 6LqqzJL8MsmkP53GGhf11YMP9EkmawYouMDP/PwQYhIiUO0CAwEAAaOCASIwggEeMA4GA1UdDwEB /wQEAwIBBjAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwQwEgYDVR0TAQH/BAgwBgEB/wIB ADAdBgNVHQ4EFgQUyzgSsMeZwHiSjLMhleb0JmLA4D8wHwYDVR0jBBgwFoAUJiSSix/TRK+xsBtt r+500ox4AAMwSwYDVR0fBEQwQjBAoD6gPIY6aHR0cDovL2NybC5nbG9iYWxzaWduLmNvbS9ncy9n c3BlcnNvbmFsc2lnbnB0bnJzc2hhMmcyLmNybDBMBgNVHSAERTBDMEEGCSsGAQQBoDIBKDA0MDIG CCsGAQUFBwIBFiZodHRwczovL3d3dy5nbG9iYWxzaWduLmNvbS9yZXBvc2l0b3J5LzANBgkqhkiG 9w0BAQsFAAOCAQEACskdySGYIOi63wgeTmljjA5BHHN9uLuAMHotXgbYeGVrz7+DkFNgWRQ/dNse Qa4e+FeHWq2fu73SamhAQyLigNKZF7ZzHPUkSpSTjQqVzbyDaFHtRBAwuACuymaOWOWPePZXOH9x t4HPwRQuur57RKiEm1F6/YJVQ5UTkzAyPoeND/y1GzXS4kjhVuoOQX3GfXDZdwoN8jMYBZTO0H5h isymlIl6aot0E5KIKqosW6mhupdkS1ZZPp4WXR4frybSkLejjmkTYCTUmh9DuvKEQ1Ge7siwsWgA NS1Ln+uvIuObpbNaeAyMZY0U5R/OyIDaq+m9KXPYvrCZ0TCLbcKuRzCCBB4wggMGoAMCAQICCwQA AAAAATGJxkCyMA0GCSqGSIb3DQEBCwUAMEwxIDAeBgNVBAsTF0dsb2JhbFNpZ24gUm9vdCBDQSAt IFIzMRMwEQYDVQQKEwpHbG9iYWxTaWduMRMwEQYDVQQDEwpHbG9iYWxTaWduMB4XDTExMDgwMjEw MDAwMFoXDTI5MDMyOTEwMDAwMFowZDELMAkGA1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24g bnYtc2ExOjA4BgNVBAMTMUdsb2JhbFNpZ24gUGVyc29uYWxTaWduIFBhcnRuZXJzIENBIC0gU0hB MjU2IC0gRzIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCg/hRKosYAGP+P7mIdq5NB Kr3J0tg+8lPATlgp+F6W9CeIvnXRGUvdniO+BQnKxnX6RsC3AnE0hUUKRaM9/RDDWldYw35K+sge C8fWXvIbcYLXxWkXz+Hbxh0GXG61Evqux6i2sKeKvMr4s9BaN09cqJ/wF6KuP9jSyWcyY+IgL6u2 52my5UzYhnbf7D7IcC372bfhwM92n6r5hJx3r++rQEMHXlp/G9J3fftgsD1bzS7J/uHMFpr4MXua eoiMLV5gdmo0sQg23j4pihyFlAkkHHn4usPJ3EePw7ewQT6BUTFyvmEB+KDoi7T4RCAZDstgfpzD rR/TNwrK8/FXoqnFAgMBAAGjgegwgeUwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8C AQEwHQYDVR0OBBYEFCYkkosf00SvsbAbba/udNKMeAADMEcGA1UdIARAMD4wPAYEVR0gADA0MDIG CCsGAQUFBwIBFiZodHRwczovL3d3dy5nbG9iYWxzaWduLmNvbS9yZXBvc2l0b3J5LzA2BgNVHR8E LzAtMCugKaAnhiVodHRwOi8vY3JsLmdsb2JhbHNpZ24ubmV0L3Jvb3QtcjMuY3JsMB8GA1UdIwQY MBaAFI/wS3+oLkUkrk1Q+mOai97i3Ru8MA0GCSqGSIb3DQEBCwUAA4IBAQACAFVjHihZCV/IqJYt 7Nig/xek+9g0dmv1oQNGYI1WWeqHcMAV1h7cheKNr4EOANNvJWtAkoQz+076Sqnq0Puxwymj0/+e oQJ8GRODG9pxlSn3kysh7f+kotX7pYX5moUa0xq3TCjjYsF3G17E27qvn8SJwDsgEImnhXVT5vb7 qBYKadFizPzKPmwsJQDPKX58XmPxMcZ1tG77xCQEXrtABhYC3NBhu8+c5UoinLpBQC1iBnNpNwXT Lmd4nQdf9HCijG1e8myt78VP+QSwsaDT7LVcLT2oDPVggjhVcwljw3ePDwfGP9kNrR+lc8XrfClk WbrdhC2o4Ui28dtIVHd3MIIDXzCCAkegAwIBAgILBAAAAAABIVhTCKIwDQYJKoZIhvcNAQELBQAw TDEgMB4GA1UECxMXR2xvYmFsU2lnbiBSb290IENBIC0gUjMxEzARBgNVBAoTCkdsb2JhbFNpZ24x EzARBgNVBAMTCkdsb2JhbFNpZ24wHhcNMDkwMzE4MTAwMDAwWhcNMjkwMzE4MTAwMDAwWjBMMSAw HgYDVQQLExdHbG9iYWxTaWduIFJvb3QgQ0EgLSBSMzETMBEGA1UEChMKR2xvYmFsU2lnbjETMBEG A1UEAxMKR2xvYmFsU2lnbjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMwldpB5Bngi FvXAg7aEyiie/QV2EcWtiHL8RgJDx7KKnQRfJMsuS+FggkbhUqsMgUdwbN1k0ev1LKMPgj0MK66X 17YUhhB5uzsTgHeMCOFJ0mpiLx9e+pZo34knlTifBtc+ycsmWQ1z3rDI6SYOgxXG71uL0gRgykmm KPZpO/bLyCiR5Z2KYVc3rHQU3HTgOu5yLy6c+9C7v/U9AOEGM+iCK65TpjoWc4zdQQ4gOsC0p6Hp sk+QLjJg6VfLuQSSaGjlOCZgdbKfd/+RFO+uIEn8rUAVSNECMWEZXriX7613t2Saer9fwRPvm2L7 DWzgVGkWqQPabumDk3F2xmmFghcCAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQF MAMBAf8wHQYDVR0OBBYEFI/wS3+oLkUkrk1Q+mOai97i3Ru8MA0GCSqGSIb3DQEBCwUAA4IBAQBL QNvAUKr+yAzv95ZURUm7lgAJQayzE4aGKAczymvmdLm6AC2upArT9fHxD4q/c2dKg8dEe3jgr25s bwMpjjM5RcOO5LlXbKr8EpbsU8Yt5CRsuZRj+9xTaGdWPoO4zzUhw8lo/s7awlOqzJCK6fBdRoyV 3XpYKBovHd7NADdBj+1EbddTKJd+82cEHhXXipa0095MJ6RMG3NzdvQXmcIfeg7jLQitChws/zyr VQ4PkX4268NXSb7hLi18YIvDQVETI53O9zJrlAGomecsMx86OyXShkDOOyyGeMlhLxS67ttVb9+E 7gUJTb0o2HLO02JQZR7rkpeDMdmztcpHWD9fMIIEZDCCA0ygAwIBAgIMB/CJK1MgpV83jiIZMA0G CSqGSIb3DQEBCwUAMEwxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9iYWxTaWduIG52LXNhMSIw IAYDVQQDExlHbG9iYWxTaWduIEhWIFMvTUlNRSBDQSAxMB4XDTE5MDMxMzA4MjIxOVoXDTE5MDkw OTA4MjIxOVowIjEgMB4GCSqGSIb3DQEJAQwRYmVtYXNjQGdvb2dsZS5jb20wggEiMA0GCSqGSIb3 DQEBAQUAA4IBDwAwggEKAoIBAQCsphkGEsCh0fF4+6Wsi1u40JxI6W6Izew+dLGK4b93LCRAuJ8y g9wSnwGAtk9/23VmtKwBrMaJD5j9SVZpscvLAjrWwADl/THU22uTW0MsUE2fPOPv2s4hE+vMgRmK P2E+xpI6n0gFvn8qrUHO1dm6PJaP5SWa+zdB/Ja1LgMJTpevQqjK4LKjWmHFPR6CplS4RImjGk7U 0I6invTyQnL5p583t5PI7FcM5UyjAqxGEETdAuc7N4IqjNETvPwL0wLIzxPDA5PMqcWPSzg7sBAB LVUQRYNIAJPlVpUdg1IeAjil5BaaWBjEeCLBSGDFX3WaWfMNzQvRZr4i6oJxzV+1AgMBAAGjggFu MIIBajAcBgNVHREEFTATgRFiZW1hc2NAZ29vZ2xlLmNvbTBQBggrBgEFBQcBAQREMEIwQAYIKwYB BQUHMAKGNGh0dHA6Ly9zZWN1cmUuZ2xvYmFsc2lnbi5jb20vY2FjZXJ0L2dzaHZzbWltZWNhMS5j cnQwHQYDVR0OBBYEFFSy8ovdLNSQc8aqxOgKS7sBOm/UMB8GA1UdIwQYMBaAFMs4ErDHmcB4koyz IZXm9CZiwOA/MEwGA1UdIARFMEMwQQYJKwYBBAGgMgEoMDQwMgYIKwYBBQUHAgEWJmh0dHBzOi8v d3d3Lmdsb2JhbHNpZ24uY29tL3JlcG9zaXRvcnkvMDsGA1UdHwQ0MDIwMKAuoCyGKmh0dHA6Ly9j cmwuZ2xvYmFsc2lnbi5jb20vZ3NodnNtaW1lY2ExLmNybDAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0l BBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMEMA0GCSqGSIb3DQEBCwUAA4IBAQCbQ++Znz6xh85ZlZEN Y/vAF0vn111O0c2houe4LlLQkoQ1QS4fH5EYcBx/393FTq5n08ezWYVtmeQ6W15e34CqjYNop1Vh mihZ+3J6+LL/6YNi91cp5yMFgxOP9aI/Y8IaIWZJAY2e8yHbYSq0z8kka0H6S4VvFjwtRogkWW95 0SStEwo/8viJ02BwpmVj4YIA6Fva1ZbeN2TnUMCAHJAlKWOGlpHxpcdcWckED0XbSY9w6bllMw1T tsbiUwQxDeO++Y8NfS8rieZgfv3RlobKihE8xbIVGRHIq1gup4nXv6XDwHDYyGhafIfUD4Ix00Wk gnODGb+jPwoQlDX0X64qMYICXjCCAloCAQEwXDBMMQswCQYDVQQGEwJCRTEZMBcGA1UEChMQR2xv YmFsU2lnbiBudi1zYTEiMCAGA1UEAxMZR2xvYmFsU2lnbiBIViBTL01JTUUgQ0EgMQIMB/CJK1Mg pV83jiIZMA0GCWCGSAFlAwQCAQUAoIHUMC8GCSqGSIb3DQEJBDEiBCCqLFhzqCIK4w/WaHBshXN8 Ivpzo2BIxuS10ae+92+1ejAYBgkqhkiG9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEP Fw0xOTA2MjAxMzE2MjRaMGkGCSqGSIb3DQEJDzFcMFowCwYJYIZIAWUDBAEqMAsGCWCGSAFlAwQB FjALBglghkgBZQMEAQIwCgYIKoZIhvcNAwcwCwYJKoZIhvcNAQEKMAsGCSqGSIb3DQEBBzALBglg hkgBZQMEAgEwDQYJKoZIhvcNAQEBBQAEggEAcfiIQya6vlwEC+/j5DOCaz7VTDWdqfzSH601B3m9 pLBJ0m+41cqbBgWA07qF9ZOUEv6+sV/bT9e2ar7Ykg3A1tKzYhd35P7HyTSQRXOGBUYOCdFHA22m cLhjHfInIzEwxq3hUEkTRwGDKriGl7btyg9yIzIT5GBaNUZDjsoGPK30NnrLUq6O0FRTrwfEWx50 GTSYZ3LPQuXWmQLFMuFgs1U9JjBr7l3lO6UyS+ubhzPwHaJdycL4EU/Wq/ypoKVv1pCErYhTRqAS ig9L6FWHDywoxOIIWkkcGOIXLTWya88JyxktZJgtG7ZWGfnGPAwv/6Kejut+d2jJbKE6MEl6Dg== --00000000000016de23058bc12714-- From nobody Thu Jun 20 06:48:54 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9FA32120113 for ; Thu, 20 Jun 2019 06:48:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id C7Q8DVb8yCB1 for ; Thu, 20 Jun 2019 06:48:43 -0700 (PDT) Received: from mail-lj1-x22e.google.com (mail-lj1-x22e.google.com [IPv6:2a00:1450:4864:20::22e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3555D1200F1 for ; Thu, 20 Jun 2019 06:48:43 -0700 (PDT) Received: by mail-lj1-x22e.google.com with SMTP id p17so2801240ljg.1 for ; Thu, 20 Jun 2019 06:48:43 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=WAwMSnukY6JFT56OrHpZYG0sn+H6Sh/42Nziy+Mx6ok=; b=vHusX41NtGHv6aIuD4n9ryhNIvjzopNgvjAf22vZYcJ/1+qadHYl9iZzC0lwcH5rI3 pmLPqWrVvqQMA4SlTFp6wGa9NP2zxftyOn2EhSMkiX9FN4m689+sA9CDAh/O8/C8nPnr KuWeWgT4+CVvvjBGhZcMetmlvXrIjpGttV5kaD+VB1GYzuHiy2jYpIq1fZBxgD4ku0jx iXfdU6nPy1U8wW8xUUvCNAePloFgGnwPAiAktSfmQsorIgz30zCQsQrLvFQA8MhOw1Ng J5Pjwe16ES8HZfMHqhs0lFziGeAkG8ixmcG7SCV1DMPalhEm014lBivC9cC0+GwoK5/r 9oog== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=WAwMSnukY6JFT56OrHpZYG0sn+H6Sh/42Nziy+Mx6ok=; b=RqyAVGyMZdgxqSNu5JfjturVQE3QZXdI+P8NA+SMFk6qc/WznbfYTDr/HQB7EabJ6q rq/3NkkZu+2ULVpG3Kvy1osjWf9qhL5t2bLjEPOh44nphzGyox4tsvvJSZjpCH0miAFD pMs4gxTpbiR0b9Xd3UvNQcOWalas/WmDP3B9sNHhxlTm+3U0gNROAw3TEAHvWbdcPzni yywpEWEexF4WcGT4kerfro/XEbsuKsaTKhQ/dMqM1Pz2tkQgzoayoFPYV48CXdL0vq2j n+ScRl7lfyrt0l/pv2gm98nXd2Ms69aKEqQbfxKLtrHffFwaf5uo2dn8b89bfy48MSKB Jnhw== X-Gm-Message-State: APjAAAVWl6NbNxbLFpl0rekJGrUgFPU7OGGvXMvw9B9U80FwayA/2Qlf SN4RWNSWv4DZcMDEf94lldJ/Y/wDfOL0wxeW7gRv8EamyCg= X-Google-Smtp-Source: APXvYqwUnQQtCjkgJzDXdyy93Tl/aL+kcL1/EVZ0xGYA2vbOIBJ0OvVDzyBX7P97cBMvplwkijfsPgVvFIYXPqhsj0M= X-Received: by 2002:a2e:9cd4:: with SMTP id g20mr18089204ljj.205.1561038521465; Thu, 20 Jun 2019 06:48:41 -0700 (PDT) MIME-Version: 1.0 References: <73fc5d1e-12ad-db81-6f0b-702d9230a2bf@cs.tcd.ie> In-Reply-To: <73fc5d1e-12ad-db81-6f0b-702d9230a2bf@cs.tcd.ie> From: Eric Rescorla Date: Thu, 20 Jun 2019 06:48:02 -0700 Message-ID: To: Stephen Farrell Cc: "tls@ietf.org" Content-Type: multipart/alternative; boundary="0000000000008d9875058bc19a92" Archived-At: Subject: Re: [TLS] ESNI and padding X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 20 Jun 2019 13:48:53 -0000 --0000000000008d9875058bc19a92 Content-Type: text/plain; charset="UTF-8" On Thu, Jun 20, 2019 at 1:20 AM Stephen Farrell wrote: > > Hiya, > > On 20/06/2019 02:17, Eric Rescorla wrote: > > I am not in favor of these changes. They reduce protocol flexibility for > > servers > > I don't see being asked to configure a new thing that has > subtle relationships with other things that aren't always > under the control of one entity as "flexibility." I see > that as a burden, and maybe as a protocol design bug. > Well, opinions differ, I suppose. The server implementor is free to implement the policies you suggest here. > which know what they are doing and largely can be implemented in the > > protocol > > by servers which do know what they are doing. > > That kind of anthropomorphism often seems to me to indicate > a weak argument:-) I'm assuming this is just snark, not something you think has any rhetorical force. Servers don't "know" anything - the question > is whether the current setup could cause problems for a range > of possible deployments, and I think it could if there's less > tight coupling between how ESNIKeys get generated and published > and how names and certificates are handled. IIUC that kind of > setup does exist in the wild. > > To give an example, say some hoster is doing ESNI and has set > padded_length to 55. If a new customer turns up with a 56 octet > name, then that hoster has to unexpectedly touch ESNIKeys or > deal with possibly weird ESNI problems for at least a TTL. If > we had an algorithmic approach it should just continue to work. > And as I said, the hoster is free to implement that value themselves. But I'm not in favor of opposing them. > Characterising that hoster as "not knowing what they're doing" > seems to me wrong. I think that'd be more a case of us not > knowing what we're doing:-) > Again, I suppose opinions differ. As to the specific numbers in my mail - I don't much care > what's picked, and do agree that some measurements would help > pick good numbers. I also agree that CertificateVerify is much > less of a concern in reality. But asking that Certificate be > padded "such that its length equals the size of the largest > possible Certificate (message) covered by the same ESNI key" > would in some cases require a new database search for each > TLS session. I don't really know why you think that. -Ekr And since the Certificate message is the path > and not one certificate that could be quite expensive to > impractical depending how a server stores/builds paths. I > also believe that some openssl deployments do this via > locally implemented callbacks so it'd be hard to know how > badly or not the current approach might affect those. > > Cheers, > S. > > > > > > --0000000000008d9875058bc19a92 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Thu, Jun 20, 2019 at 1:20 AM Steph= en Farrell <stephen.farrell= @cs.tcd.ie> wrote:

Hiya,

On 20/06/2019 02:17, Eric Rescorla wrote:
> I am not in favor of these changes.=C2=A0 They reduce protocol flexibi= lity for
> servers

I don't see being asked to configure a new thing that has
subtle relationships with other things that aren't always
under the control of one entity as "flexibility." I see
that as a burden, and maybe as a protocol design bug.
=
Well, opinions differ, I suppose. The server implementor is = free to implement the policies you suggest here.

> which know what they are doing and largely can be implemented in the > protocol
> by servers which do know what they are doing.

That kind of anthropomorphism often seems to me to indicate
a weak argument:-)

I'm assuming this i= s just snark, not something you think has any
rhetorical force.


Servers don't "know" anything - the question
is whether the current setup could cause problems for a range
of possible deployments, and I think it could if there's less
tight coupling between how ESNIKeys get generated and published
and how names and certificates are handled. IIUC that kind of
setup does exist in the wild.

To give an example, say some hoster is doing ESNI and has set
padded_length to 55. If a new customer turns up with a 56 octet
name, then that hoster has to unexpectedly touch ESNIKeys or
deal with possibly weird ESNI problems for at least a TTL. If
we had an algorithmic approach it should just continue to work.

And as I said, the hoster is free to implement tha= t value themselves. But I'm not in favor of opposing them.

Characterising that hoster as "not knowing what they're doing"= ;
seems to me wrong. I think that'd be more a case of us not
knowing what we're doing:-)

Again, = I suppose opinions differ.

As to the specific numbers in my mail - I don't much care
what's picked, and do agree that some measurements would help
pick good numbers. I also agree that CertificateVerify is much
less of a concern in reality. But asking that Certificate be
padded "such that its length equals the size of the largest
possible Certificate (message) covered by the same ESNI key"
would in some cases require a new database search for each
TLS session.

I don't really know why yo= u think that.

-Ekr

And since the Certificate messa= ge is the path
and not one certificate that could be quite expensive to
impractical depending how a server stores/builds paths. I
also believe that some openssl deployments do this via
locally implemented callbacks so it'd be hard to know how
badly or not the current approach might affect those.

Cheers,
S.





--0000000000008d9875058bc19a92-- From nobody Thu Jun 20 06:50:34 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0A5F8120045 for ; Thu, 20 Jun 2019 06:50:33 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.3 X-Spam-Level: X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xzeXyIaU24ag for ; Thu, 20 Jun 2019 06:50:30 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0012912000F for ; Thu, 20 Jun 2019 06:50:29 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id 10A1EBE7B; Thu, 20 Jun 2019 14:50:28 +0100 (IST) Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id acuoqzIHnZUb; Thu, 20 Jun 2019 14:50:27 +0100 (IST) Received: from [134.226.36.93] (unknown [134.226.36.93]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id C358EBE20; Thu, 20 Jun 2019 14:50:27 +0100 (IST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1561038627; bh=KN9RVXI5C5R7IPccNH1SuwgHCcIddRyldqScIwq9Xvo=; h=Subject:To:Cc:References:From:Date:In-Reply-To:From; b=Vfqm2/N9kjg5p9D2p/QQ9cAm7qMAVAv2e33J+YClgyQrnY5vBsQq85P6pLkob3NUO vgWdFfp6ZkstFbD+pmwGx2aJADkSkcuL+b1ERzatRDmNGIwBdWetzVIS88BUHVwew6 TzIulkit/I4731zB9OxSneGhrSm0h9uAwWQ6QC1E= To: Ben Schwartz Cc: "tls@ietf.org" References: <65bae8fa-36b1-4724-4107-2e0e02a6adc6@cs.tcd.ie> From: Stephen Farrell Openpgp: id=5BB5A6EA5765D2C5863CAE275AB2FAF17B172BEA; url= Autocrypt: addr=stephen.farrell@cs.tcd.ie; prefer-encrypt=mutual; keydata= mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nemCP5PMvmh 5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kTq0IqYzsEv5HI58S+ QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtEgvw4fVhVWJuyy3w//0F2tzKr EMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy+pAh4EKzS1FE7BOZp9daMu9MUQmDqtZU bUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqO Vz+7L+WiVfxLbeVqBwV+4uL9to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJg b097ZaNyuY1ETghVB5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k 4LyM2lp5FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9tlyWxn5Xi HzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQABtDJTdGVwaGVuIEZh cnJlbGwgKDIwMTcpIDxzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPokCQAQTAQgAKgIbAwUJ CZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAUCWj6jdwIZAQAKCRBasvrxexcr6o7QD/9m x9DPJetmW794RXmNTrbTJ44zc/tJbcLdRBh0KBn9OW/EaAqjDmgNJeCMyJTKr1ywaps8HGUN hLEVkc14NUpgi4/Zkrbi3DmTp25OHj6wXBS5qVMyVynTMEIjOfeFFyxG+48od+Xn7qg6LT7G rHeNf+z/r0v9+8eZ1Ip63kshQDGhhpmRMKu4Ws9ZvTW2ACXkkTFaSGYJj3yIP4R6IgwBYGMz DXFX6nS4LA1s3pcPNxOgrvCyb60AiJZTLcOk/rRrpZtXB1XQc23ZZmrlTkl2HaThL6w3YKdi Ti1NbuMeOxZqtXcUshII45sANm4HuWNTiRh93Bn5bN6ddjgsaXEZBKUBuUaPBl7gQiQJcAlS 3MmGgVS4ZoX8+VaPGpXdQVFyBMRFlOKOC5XJESt7wY0RE2C8PFm+5eywSO/P1fkl9whkMgml 3OEuIQiP2ehRt/HVLMHkoM9CPQ7t6UwdrXrvX+vBZykav8x9U9M6KTgfsXytxUl6Vx5lPMLi 2/Jrsz6Mzh/IVZa3xjhq1OLFSI/tT2ji4FkJDQbO+yYUDhcuqfakDmtWLMxecZsY6O58A/95 8Qni6Xeq+Nh7zJ7wNcQOMoDGj+24di2TX1cKLzdDMWFaWzlNP5dB5VMwS9Wqj1Z6TzKjGjru q8soqohwb2CK9B3wzFg0Bs1iBI+2RuFnxLkCDQRaPVAyARAA+g3R0HzGr/Dl34Y07XqGqzq5 SU0nXIu9u8Ynsxj7gR5qb3HgUWYEWrHW2jHOByXnvkffucf5yzwrsvw8Q8iI8CFHiTYHPpey 4yPVn6R0w/FOMcY70eTIu/k6EEFDlDbs09DtKcrsT9bmN0XoRxITlXwWTufYqUnmS+YkAuk+ TLCtUin7OdaS2uU6Ata3PLQSeM2ZsUQMmYmHPwB9rmf+q2I005AJ9Q1SPQ2KNg/8xOGxo13S VuaSqYRQdpV93RuCOzg4vuXtR+gP0KQrus/P2ZCEPvU9cXF/2MIhXgOz207lv3iE2zGyNXld /n8spvWk+0bH5Zqd9Wcba/rGcBhmX9NKKDARZqjkv/zVEP1X97w1HsNYeUFNcg2lk9zQKb4v l1jx/Uz8ukzH2QNhU4R39dbF/4AwWuSVkGW6bTxHJqGs6YimbfdQqxTzmqFwz3JP0OtXX5q/ 6D4pHwcmJwEiDNzsBLl6skPSQ0Xyq3pua/qAP8MVm+YxCxJQITqZ8qjDLzoe7s9X6FLLC/DA L9kxl5saVSfDbuI3usH/emdtn0NA9/M7nfgih92zD92sl1yQXHT6BDa8xW1j+RU4P+E0wyd7 zgB2UeYgrp2IIcfG+xX2uFG5MJQ/nYfBoiALb0+dQHNHDtFnNGY3Oe8z1M9c5aDG3/s29QbJ +w7hEKKo9YMAEQEAAYkCJQQYAQgADwUCWj1QMgIbDAUJCZQmAAAKCRBasvrxexcr6qwvD/9b Rek3kfN8Q+jGrKl8qwY8HC5s4mhdDJZI/JP2FImf5J2+d5/e8UJ4fcsT79E0/FqX3Z9wZr6h sofPqLh1/YzDsYkZDHTYSGrlWGP/I5kXwUmFnBZHzM3WGrL3S7ZmCYMdudhykxXXjq7M6Do1 oxM8JofrXGtwBTLv5wfvvygJouVCVe87Ge7mCeY5vey1eUi4zSSF1zPpR6gg64w2g4TXM5qt SwkZVOv1g475LsGlYWRuJV8TA67yp1zJI7HkNqCo8KyHX0DPOh9c+Sd9ZX4aqKfqH9HIpnCL AYEgj7vofeix7gM3kQQmwynqq32bQGQBrKJEYp2vfeO30VsVx4dzuuiC5lyjUccVmw5D72J0 FlGrfEm0kw6D1qwyBg0SAMqamKN6XDdjhNAtXIaoA2UMZK/vZGGUKbqTgDdk0fnzOyb2zvXK CiPFKqIPAqKaDHg0JHdGI3KpQdRNLLzgx083EqEc6IAwWA6jSz+6lZDV6XDgF0lYqAYIkg3+ 6OUXUv6plMlwSHquiOc/MQXHfgUP5//Ra5JuiuyCj954FD+MBKIj8eWROfnzyEnBplVHGSDI ZLzL3pvV14dcsoajdeIH45i8DxnVm64BvEFHtLNlnliMrLOrk4shfmWyUqNlzilXN2BTFVFH 4MrnagFdcFnWYp1JPh96ZKjiqBwMv/H0kw== Message-ID: Date: Thu, 20 Jun 2019 14:50:27 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.7.0 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="K4ING8H6MfWozgUW6GbtKmpuQ1TrL8nsU" Archived-At: Subject: Re: [TLS] ESNI and padding X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 20 Jun 2019 13:50:33 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --K4ING8H6MfWozgUW6GbtKmpuQ1TrL8nsU Content-Type: multipart/mixed; boundary="WYkFUcsflSbWGQTBCu3aWqdKmM1qNIIHA"; protected-headers="v1" From: Stephen Farrell To: Ben Schwartz Cc: "tls@ietf.org" Message-ID: Subject: Re: [TLS] ESNI and padding References: <65bae8fa-36b1-4724-4107-2e0e02a6adc6@cs.tcd.ie> In-Reply-To: --WYkFUcsflSbWGQTBCu3aWqdKmM1qNIIHA Content-Type: multipart/mixed; boundary="------------CED542FEF88DDE4BD6453D95" Content-Language: en-GB This is a multi-part message in MIME format. --------------CED542FEF88DDE4BD6453D95 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable On 20/06/2019 14:16, Ben Schwartz wrote: > However, as a matter of overhead, your test suggests that RFC 8467 roug= hly > doubles the size of each query packet. That's similar to the proportio= nal > effect of maximum ESNI padding on a typical ClientHello. Proportionall= y, I > expect RFC 8467 adds more padding to the whole DNS transaction than cur= rent > ESNI adds to the whole TLS handshake. It might even be true in absolut= e > terms, on average. In the context of a full TLS connection, the > proportional impact of ESNI is even smaller. Sure, compared to the full TLS exchange padded_length=3D=3D260 isn't so much. >=20 >> Again though, I think considering DNS query padding argues >> that this ought be a client-driven thing and not tied to the >> ESNIKeys. >=20 > One important difference between these cases is that DNS is essentially= an > "open world", where no one knows the whole space of possibilities, wher= eas > a specific server is a "closed world", a finite set of domains (known o= nly > to the server operator). That puts the server operator in the unique > position to make correct padding decisions, and also makes the adversar= y's > job much easier if the padding is incorrect. True, but not always true, in the sense that the server s/w may not have such an easy job knowing the sizes in all deployments (for Certificate padding) and similarly keeping that in whack with the padded_length in the DNS can be tricky as it can involve multiple entities. (But I'm starting to repeat myself:-) >=20 >> If no padding was used for DoT or DoH, the ESNI >> length may already have leaked regardless of the padded_length. >> That said, I'm not sure what, if any, padding is being done >> by DoT or DoH clients. (I use stubby and it does some padding >> sometimes but I'm not sure what.) >> > In general, I think we should assume that no SNI information is leaking= > through other channels when making design choices for ESNI. Otherwise,= we > risk ESNI itself becoming the limiting factor in the future as those ot= her > leaks are fixed. Sure. I fully agree with that, but nonetheless if DNS query padding and ESNI padding are both being done as we'd like, then having both be controlled on the same side of the TLS connections seems more robust to me. Cheers, S. --------------CED542FEF88DDE4BD6453D95 Content-Type: application/pgp-keys; name="0x5AB2FAF17B172BEA.asc" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="0x5AB2FAF17B172BEA.asc" -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nem CP5PMvmh5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kT q0IqYzsEv5HI58S+QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtE gvw4fVhVWJuyy3w//0F2tzKrEMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy +pAh4EKzS1FE7BOZp9daMu9MUQmDqtZUbUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5 iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqOVz+7L+WiVfxLbeVqBwV+4uL9 to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJgb097ZaNyuY1ETghV B5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k4LyM2lp5 FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9t lyWxn5XiHzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQAB tCFTdGVwaGVuIEZhcnJlbGwgPHN0ZXBoZW5AamVsbC5pZT6JAj0EEwEIACcFAlo9 UYwCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQWrL68XsXK+qG CxAApYHWYgGOIL3G6/OpkejdAkQoCVQAK8LJUSf6vzwost4iVfxIKcKW/3RqKNKk rRl8beJ7j1CWXAz9+VXAOsE9+zNxXIDgGA7HlvJnhffl+qwibVgiHgUcJFhCSbBr sjC+1uULaTU8zYEyET//GOGPLF+X+degkE/sesh4zcEAjF7fGPnlncdCCH3tvPZZ sdTcjwOCRVonKsDgQzBTCMz/RPBfEFX44HZx4g1UQAcCA4xlucY8QkJEyCrSNGpG nvGK8DcGSmnstl1/a9fnlhpdFxieX3oY2phJ1WKkYTn6Advrek3UP71CKxpgtPmk d3iUUz/VZa0Cv6YxQXskspRDVEvdCMYSQBtJPQ4y2+5UxVR9GIQXenwYp9AP2niv Voh+ITsDWWeWnnvYMq07rSDjq0nGdj41MJkNX+Yb2PXVyXItcj5ybE3T2+y3pSBG FEZYJGuaL4NwtBJFMOdOtBmUOPbetS2971EL3Izxb7ibOZWDwexv+8R6SWYfP1wV N3p46RyBQuXqJV8ccE11m6vtZTGSYgnLUUFZMRQYH+0hwuYe0T3AA18xDdSYsa8v ovCCd3l5S4UNzIM2PMChqGrEzKapUpZg7+8ACcxRU3b9Ihd7WYjJ+pQPCoWYKozv tEvenbNpE/govO/ED3B14e+R2yevRPjRrsN7PJzSf15fQLuJARwEEAEIAAYFAlo9 UqAACgkQLzyHNoBfjaLrSwf+MIHbFRQ4O5cmLYR5sIByWelN3SuRN/gW8rpKo9Ok Cz6An8uV/iCXy5tNMLzzi0BFl8f22DwBcC5qy9qnlIAdogWam1qWoTAoAD8veEqm uKhYrqJsCcAyNrKYmK0hP3rpHxx1LySDmKYXmw/8qtBXKHTouMm+5tSsznhykRMT AAr2p7PSaHgo+hIVaW/rKSspHjDhhZS+G9mtOZad1IH29M6G1Q1NCO0Ywe8krKLQ IAQlFxtgvOqpPOZNzeKBa/+KbE8TGgMWrkOhC8OeEM5PVzdDhlhD9kPzB/pCKDF5 DofJ/ZRqnDpbKPQ0bsW38AOig3kOc0A27awiBEw3urqR1YkCMwQQAQgAHRYhBH4X CgRchM9GDit5oBDvedn9g1MSBQJbtyScAAoJEBDvedn9g1MSI/oP/0A9J9nrnBMq Zpm857lfYWw+rshLK+tyeP4OQeOqnDFvs9jePpcyJLG3DF2r6VbVKPQq+AE6Uf5h cJBDEN6BjEhRPSbLcqG3A1cz/nNwm8rPmNp+oKhmaBBQGxwciMLmzgynsDydnjPp MyEs04zvsbsl4vrp2095o105l8KcrrxQrioFjbwveGwHQK9bxJKhx9D+gIk+MouB ur45UDKTZkMZrr9FGrtkyXCGAxvKdcNC5Oa8z9sj1rcUJfG/OpVAMWhArdlZbFUQ yoX6pU2Zb1CR2qpWAVerGSfBhmfCyStjARqaKxlftjO+Bj3Jj73Cr5eqej3qB5+V 4BCsPjr4RLvVbYUCPsRdxWc+nBLlfVYkRURu21g1hFm5KFPjgUkyo1s4vjUOY8Dy I+xLGF7f/IhUBG6l+Vswhpwu7ydalZkeFiPx5xna5NfbEYxvsIf71DvipGvIOaHv X4egWoFgm8n/9c3rcMxJtpwHPSsUt5dgLsyu6VE0IbvOAc3dN7CWJ355DVFJq9Zg 2YVf0izSpyyzJeGsgkfjW6xpmdvZxuT2UcN4BTcm6vYqueASGrb3lfhzC5gpeVsc /MoSjTS65vNWbpzONZWMZuLEFraxWJzC0JrDK3NCd0VN3kstqGkVbUIiYOnUm8Vu 4zoVMLlGWzHLIGoPRG2nRezn1YyNfyb5iQGcBBABCgAGBQJbxcflAAoJEGo7ETk8 pK1gE7QL/ApC5P68W5DrI1787WJVZv1u4t/g39vTr7Xer3UMTVQg10vpa7pmqOGh jIDzDMg3Pe3K3M7fVzfAlUA1qw6ne4RCueVoRKpubeF4AlYbMr0K6hNCPjt5uAxm bBVuejKTc6pru5rv5gKL0nDbr+Snft5xt7juBLSSimw0/41sZnkjCxo9rF/RA/v6 +uWyK171RKmsEYu8fFtw1eqUNt/Xj792TUixE3pxXheNtQtZGk/9P3W83ChhG4Fh 5EQsn0pIh9wZIAbMRLpgRKyW87fWHZC8/YH8h7afarvn9Thl5pFUldCe22mNJj6K LChn2aEHQd+PdY1GBpZEcmNEUPuovwzatM0h64hCzTm41eDqRfihZVBT7TbfXQnv 8rywa42Mk756RGzzEZcQEhwQXZcMQUfxIQQ2VyJo0zG36VdZTQF7TF/4Lz7/3cJ5 6jOIm+dwPXtu+C2wAQuD4USOLt4JWPYpqzDfHYJIND/497P9Z9SuQeahr2ez3DRB g3qsHEjBV7QyU3RlcGhlbiBGYXJyZWxsICgyMDE3KSA8c3RlcGhlbi5mYXJyZWxs QGNzLnRjZC5pZT6JAkAEEwEIACoCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwEC HgECF4AFAlo+o3cCGQEACgkQWrL68XsXK+qO0A//ZsfQzyXrZlu/eEV5jU620yeO M3P7SW3C3UQYdCgZ/TlvxGgKow5oDSXgjMiUyq9csGqbPBxlDYSxFZHNeDVKYIuP 2ZK24tw5k6duTh4+sFwUualTMlcp0zBCIzn3hRcsRvuPKHfl5+6oOi0+xqx3jX/s /69L/fvHmdSKet5LIUAxoYaZkTCruFrPWb01tgAl5JExWkhmCY98iD+EeiIMAWBj Mw1xV+p0uCwNbN6XDzcToK7wsm+tAIiWUy3DpP60a6WbVwdV0HNt2WZq5U5Jdh2k 4S+sN2CnYk4tTW7jHjsWarV3FLISCOObADZuB7ljU4kYfdwZ+WzenXY4LGlxGQSl AblGjwZe4EIkCXAJUtzJhoFUuGaF/PlWjxqV3UFRcgTERZTijguVyREre8GNERNg vDxZvuXssEjvz9X5JfcIZDIJpdzhLiEIj9noUbfx1SzB5KDPQj0O7elMHa1671/r wWcpGr/MfVPTOik4H7F8rcVJelceZTzC4tvya7M+jM4fyFWWt8Y4atTixUiP7U9o 4uBZCQ0GzvsmFA4XLqn2pA5rVizMXnGbGOjufAP/efEJ4ul3qvjYe8ye8DXEDjKA xo/tuHYtk19XCi83QzFhWls5TT+XQeVTMEvVqo9Wek8yoxo67qvLKKqIcG9givQd 8MxYNAbNYgSPtkbhZ8SJARwEEAEIAAYFAlo9UqAACgkQLzyHNoBfjaLzHAgAlWT6 NXEGtw/r1miKNGcopzvzILQ9oB8rKI9U9EL6tOf/y2V5oYee/GyQDb3ZdoPxxYYc Jf+RyiH1nMoqUIZiZJaf3bJXinDZ5+AdfE++UR2NBvqaNyC6u3r24jo1B/sagKbY tWgsYtRqHLD4IWi37MZrVyjBuF7u14Q07+uhjq6mX2O/tHpCYw/Q82tbeTRPyUf1 WQOAfD1kfBpW9PvAva5Iw9FWeXpCXRzwxnCZhYfGfqtuSw6CPBYLdbikqML6FZ7E DuTBb/8um1wK7Y9bgeIQC+CYjhYB5RXa1tDJRab2Js4luCvSR0w/CgHw26293tlv e2Q6UTrmHxP5U22DlokCPQQTAQgAJwUCWj1QMgIbAwUJCZQmAAULCQgHAgYVCAkK CwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6tJpD/4rrILH+meP07vrx8wW5eYuqCiP GYnh/CXxIF8eLrfbe5d4QRgtq+w6UeQPMyzKRIRiCoBXB2oJLBZHyxBPxZlg33dT MrEGn8QWKx2iNuz9rZMXyOSWFetuO01d/aUPd5BnbLbIyK5of8xCQlXM6KH8bc+9 gQ7edR9mfLTdvBf2FR522hg8BRBM1imKc3vO8v39+qIHHRjuiwxBBCAOhHtHRsZX ripS0uFA07dM46Oi/E8osjx6fQt/lH5z/PN+2adxYSrLSAXfr1oD3RxYNhuWgyGF L64/VCQb1YGjf0Z5MBPnWm9jgUoOY5K9eNSS0L83WeJjlF5+Q/WOgB+rb49Prm2D Feo9+S9f2V53Llz1WIspXJg6f+n9lmHE94MfQj1GAHCzI0FeL19lvM+LhD8jJSCb hrC3+yobyy/AUOs5Z3E+njjX1FF/VCVAs6iOa6i+XG+Y1hh3ir2y1kckJ5auT10M SU8GEZu9ayU4M3o3N9yxOjaoP0NuQ4MMLL/n/u4u94AeZaHPNBXn/hVfVRRmpRXt GKvJtFAEppGEYezB+bLKIm6XlpPkhnwYzleLZ7AMEco2C6QM8QPB3g3JpS3sqRhA 5rEP4lL16BmijmF+CHoPE/zwgKZbKpyVDqvIW5IDgvfIC2X4pbZDRvGIUKaGSB4+ ksZgUUnNyvfQr2p7jokCMwQQAQgAHRYhBH4XCgRchM9GDit5oBDvedn9g1MSBQJb tySbAAoJEBDvedn9g1MSeKkQAJm44jt1kwHgQgeDBKdjdvl0AjE0xVEQxriZ6lP/ l//34YT0auFfzsYIrChSpQXAEtobBAr4Ohw1Us+BZe+H5P8vm6LRuPwozC3SjwfX 4Iec8+9ot6tIVg4sbedDSgb/CCFVjsmIGcQ1P73JLJTBJ6mxYCV/gn3QC6bwDOFo 7kD9FDHCjRN8XfhHQ4Q9cYyt06uF31qG/aumgWYC9geCGgAwiHgwxNYb9GoJ0iZj CROwbYvLTcQgsVUW2bTmsVR13UVKDsdl02sRV7qcVYW6R0a3Ra8KudX+nt25H5DR Gd382KZ5W8pydsy/viTvD9z6v0ulChBYxAedIvGIClrhbxlLEPmIg4ImVOLGqsUg Vm32J95WOjEkk4PEZ12xSDBtwhSJqmJNboWlfmw43KdIbY8zNhffIO3N6O7FsdGx mqyHeLoTpqY+ySVUPpbuyW8ujnI/J//+6hdTZ9dQsEJQlWngKuWOQ5ma58MPSN88 zllsqhZAFQjNxqnkSzL6ZQ+v/jvuRRe16B80AeO55DsmbWsMv/YLLD1mSi7+Khy2 EtMBhgojWwrGMvdLN6X3mnzNJEscYyLxM9tSk+iySP2sLthK0BVgpAzBSdaf/ezI z60P+neHDzteNFf8Mn7lmgYk1amvZoJ29s5+n2HwxyRL5dVMyMdyQmntubbctfqr Z0tIiQGcBBABCgAGBQJbxcflAAoJEGo7ETk8pK1gnCYMAJY4FeIYjlIXGghFWzsB 4fYwK1+iaFpU3fSto5qcrqVtVPjXpwqczqBWeXGyQxiB0kan4OVAXydIeaP8EAuF CA7paP3s9STLJBO3KurkwyRkPW5zo0X7xVqaVToRsX2Ul98KVJoHYQD1KdezEtwl vpNwiiBr42AYR751Vm6JBVAbQXuFpB3c8bUV0OkkRxNFtL8/2PieHar58n5dntGk bPlPkztahsFqktgacIgXHX5vaT+7YeeZ1DWLOYjGO0wNhkOSeroCmxwJUikU7joB p823L7r5KfpqWTPpSCzVstQKZUGmmoE1qCswY/Ud5wvp9SccpIILkRXj0rZRtfnE 5MpL3hjmtNzfDd9qIsJtBJlSB2hZwAsVm1l+EWN9hG3tqyA43niUMy2n6q690of3 berSiQ+kvY/aC9Hx8I+bKzOV9/J2VUTqfaPZa4Uy2rVX5Q2p69n/PMj7mEer0rCL 3j9V16J9c+s0BSkXoKdtYdB0TWVhBgUybd9qtYcwHWvhP7QuU3RlcGhlbiBGYXJy ZWxsIDxzdGVwaGVuQHRvbGVyYW50bmV0d29ya3MuY29tPokCPQQTAQgAJwUCWj1R WgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6jsc EADEcB0WQEZn2AkrzDs1RhL0Lp6cZi0BigofkbcGfdhJyMSs19C0dhvncrAFClVI 6/Udw3yFtDyYtOCf2W3M3A1K6/RfEizCLzTsdFIhni9gOJLlUpXViQtgrlstjk7h qVV3Ooz4BlCqS4cG7rfqf4LQQPpTAuFUEV9I28FBUB2irqC+v4gTysIgpMw0bA1y BU9sX5jE/tRkzqnuzZrkwiobDtRFJ9qp+7O2JtcY4EsVtLAsaodJKc5cF8R4OvB1 n66vxxcgg9Eh4JNWZ47xsaCmAGo1Bcb2jIY35OtgAL7gCGLRSMKTtAaPy1/fEgIq hCljJ9x40Fkn/3r2BX21WC9HFSPFTBz2RluLRzxdgxOrkYK8EiHUPoE5b1AEzZKw 2AbeXfr57f5zYsN3IqfbQLUjMYtUN1wK3Pjb+idD972wyXMWt8uOzlI7b9Ocu+nY m2whBfJv9Pmp3QYTmPz+LB9lH65VNVUSxSXVr5iWXO3qx1HtEiGEqkporMQCTh3T 5Ud3PvMSRBFFKNs9WhJ/Lxz+SV30WLwG6dr5mQqlzAhb4Phc/zekZyXRdS/oDKrB LUucS36O//49JeyRi1QvOfxnfmIqRIAf/k3PoYJmTo5E82//r5Qj3YGlRu78ba0H Arxs+ACD6AnEHHcbswpbtVEKYzlSu0Ar0Dc7vRWM/IyQdIkBHAQQAQgABgUCWj1S oAAKCRAvPIc2gF+NosIsB/9f/29FNla3BJfGIEIDnhrqGD0i9bSa89SqBd++uG06 TQgW5wsqtNcrwn81yZTq6XE6i9VtD4GKfqC0d4KZJr9bnbeD81cI64VOdL8zJWJs 0vj5EIXCobKyX74Kb4uePUyZqwT2Q74I116u/HwA9/FXsPo5isbh4ZqD4t0VHpWk mfq1FPT9a/JPyX46qKqB2Fce/7Qy+SQP1NfkuUlbhUH/JG9aSSYvk3lznNiH41x9 M+FDlL106itXOubrl3oi2fT3fsSedq7uzt+IV0DQEeNaoQAUuwEhdB8IWOMqN2wo DjGVKJftfsSWY9ilZrnDBNDrp0vRqcx33LUMkIw4d7iBiQIzBBABCAAdFiEEfhcK BFyEz0YOK3mgEO952f2DUxIFAlu3JJwACgkQEO952f2DUxJjuw/6ApHSsVTWD4a0 H6FJ23A9Ftpy+aXZ4vYlzkSrfsn2ECrEfK3lXQh/uzwjJUDYZeB1/BQsFZtcYNQO JSSHbQ49BFRLwb1J/wBZG4bbmrkLxnNbKDKQvzxEpclkMW0Dj0J6o7kGrmzIGGrh B+JJN99AcineHRug8ZSFIERRCmigxdhAKU0BFD7P+5HNHltSL3DF1c2fFOf2JrgB KVoE+9RhMZjWNbYetFFLCkjXb5Rpay9zeMm1DxfSTGAnuOwUXW6qq4hnl5+VC/48 ceDZElLLfu7RQUZv44pkSTOWZs+iQoJiHMFHk9wPqyB2Vok1yJ2a2j27WhXrJlPw nZbgJO5RyWDG3p/eVmpl5Uuc2dsfIpR17KnAuWpghK6V+cyFncDoGCl/YG2Mvool sW08FiZh3Ej4dnJjj25TZkeFG74JJDXLvMYpJfSBGnmETv4Dhcm2xPqVMuFuL1qJ lMbVLrMo2GXeo03OzNyvbs+u8WLIaGm5hC7N1CXY8wZs4jo6OJ/expvnc07dEuws 4zT3AiWv3nIouWReRStZy9QkavDocqbyPmilcdPCYk4BsOlzpwwO74hNG7iyl0Kd AlwTxGQ7y0rJou6HYa1TmRhIEr3vKvlW+JfUUrqtjXgsuacTXo4+Ira2JUErL2cY zQMq1j4r1ZyhFnuz93s7Rsx/Nw0+0YuJAZwEEAEKAAYFAlvFx+UACgkQajsROTyk rWCJqwv+NLVPE4sD4sDA2/6Ek7UsRIUkg+S39fhqWsLc4rtw/mDunv8Un61I3K04 fZ2Ry4nF9hZM0a710UvXFbStvrzRJO3EAAcdJR9LTCd19e8UeruQbIee3YT91U4N kC9JMpecfq62/teOAU2e5P3fWYaLs5ZX7zCLwWuBcW2l3SyoljQczM85HhJ3XHm+ FnwQ6D9xRle+lvWTcuC9d1yAyUb8IOospcL2lJTmy8e3r79R24hPlSB4LDe0wEN8 AXbagrcAQZjwyaHyWxjJbTwZ0b43WGdfIqZ1ElOeoffbketPGRmWvx5xUvb2ALFB BdETzV270gs5XDJgJ1SIIKOyDADxwvroTe2jD8C/841eEql5QSow3s/U3zRqk3mt tto8Qw/DN71aeh6dmYSsvd2UjsHw/vofOPRBGxZLEkKTEvMnhmMW9hiKPkPia+Qg evYE020qpKSxLEdWA8nprHwxmGiDNesCfXSC6vm1qfyj5g8HzxSckq9ZaMhKMCo7 vxflUEDuuQINBFo9UDIBEAD6DdHQfMav8OXfhjTteoarOrlJTSdci727xiezGPuB HmpvceBRZgRasdbaMc4HJee+R9+5x/nLPCuy/DxDyIjwIUeJNgc+l7LjI9WfpHTD 8U4xxjvR5Mi7+ToQQUOUNuzT0O0pyuxP1uY3RehHEhOVfBZO59ipSeZL5iQC6T5M sK1SKfs51pLa5ToC1rc8tBJ4zZmxRAyZiYc/AH2uZ/6rYjTTkAn1DVI9DYo2D/zE 4bGjXdJW5pKphFB2lX3dG4I7ODi+5e1H6A/QpCu6z8/ZkIQ+9T1xcX/YwiFeA7Pb TuW/eITbMbI1eV3+fyym9aT7Rsflmp31Zxtr+sZwGGZf00ooMBFmqOS//NUQ/Vf3 vDUew1h5QU1yDaWT3NApvi+XWPH9TPy6TMfZA2FThHf11sX/gDBa5JWQZbptPEcm oazpiKZt91CrFPOaoXDPck/Q61dfmr/oPikfByYnASIM3OwEuXqyQ9JDRfKrem5r +oA/wxWb5jELElAhOpnyqMMvOh7uz1foUssL8MAv2TGXmxpVJ8Nu4je6wf96Z22f Q0D38zud+CKH3bMP3ayXXJBcdPoENrzFbWP5FTg/4TTDJ3vOAHZR5iCunYghx8b7 Ffa4UbkwlD+dh8GiIAtvT51Ac0cO0Wc0Zjc57zPUz1zloMbf+zb1Bsn7DuEQoqj1 gwARAQABiQIlBBgBCAAPBQJaPVAyAhsMBQkJlCYAAAoJEFqy+vF7FyvqrC8P/1tF 6TeR83xD6MasqXyrBjwcLmziaF0Mlkj8k/YUiZ/knb53n97xQnh9yxPv0TT8Wpfd n3BmvqGyh8+ouHX9jMOxiRkMdNhIauVYY/8jmRfBSYWcFkfMzdYasvdLtmYJgx25 2HKTFdeOrszoOjWjEzwmh+tca3AFMu/nB++/KAmi5UJV7zsZ7uYJ5jm97LV5SLjN JIXXM+lHqCDrjDaDhNczmq1LCRlU6/WDjvkuwaVhZG4lXxMDrvKnXMkjseQ2oKjw rIdfQM86H1z5J31lfhqop+of0cimcIsBgSCPu+h96LHuAzeRBCbDKeqrfZtAZAGs okRina9947fRWxXHh3O66ILmXKNRxxWbDkPvYnQWUat8SbSTDoPWrDIGDRIAypqY o3pcN2OE0C1chqgDZQxkr+9kYZQpupOAN2TR+fM7JvbO9coKI8Uqog8CopoMeDQk d0YjcqlB1E0svODHTzcSoRzogDBYDqNLP7qVkNXpcOAXSVioBgiSDf7o5RdS/qmU yXBIeq6I5z8xBcd+BQ/n/9Frkm6K7IKP3ngUP4wEoiPx5ZE5+fPIScGmVUcZIMhk vMvem9XXh1yyhqN14gfjmLwPGdWbrgG8QUe0s2WeWIyss6uTiyF+ZbJSo2XOKVc3 YFMVUUfgyudqAV1wWdZinUk+H3pkqOKoHAy/8fST =3DYzQY -----END PGP PUBLIC KEY BLOCK----- --------------CED542FEF88DDE4BD6453D95-- --WYkFUcsflSbWGQTBCu3aWqdKmM1qNIIHA-- --K4ING8H6MfWozgUW6GbtKmpuQ1TrL8nsU Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEW7Wm6ldl0sWGPK4nWrL68XsXK+oFAl0LjyMACgkQWrL68XsX K+onmRAAgWRB8EbcCV8Jk4k5Q7NnVYO6iam8RsT6qzvm2SQixiHLOY8IXQQHucgQ zVY/CApbysMR0t+ufg+Xyem01GRjhAnMihlA3Kmlea0U5z13F47V9oEIfuDC5QTM kplnvSm8ESUJChttzhTXgH6BOfZk4431t3taeUatnV8AkUBaajYSIb5pvJVySL1v AyC1Koi6iJacKOJQ6Say7ZcRxXeX+ByS1gCDCy7P+1jd8Qa2Az6KBIYmZM2IvY9l kUZmOcKNcDBndjwJ45deQSjG5hdp+i9dEs8yk79WtNeM0P0pqzITz9lHo5ooN8qM SvG4n5uY8DRysX+jSu8Gko12mD3+pMCqUFCnQ9id1RD9mc21NYjzrAIZ4OysNrzc Cbf9XAKLNl1xAorLRo6HScIWIkXsENcgt51yOei7x+y/qdAq63iAJUNCaUXDiMR2 Lh2axsYabm++gi3XOb23TteSsUM50X/oZdk26+zLSPhtNLNW7I86Zwi+wakuQIim 6aWWLCTIkNoQlTSNYNFfCB9mIptdlFQjUmAhBC2kRtnp2Jm4PGnRB022GDC836t7 z54QkCmhgIivLbgpepSx6X5IWn/SgtvIBUhXpw3gcCDIrmlVXBI5ISj0wtTu9dX6 QuqgiUfRGChODFK3CNg6ACq0FCCmkPA5BhZoLyCuJDZPUuZWtso= =VzG8 -----END PGP SIGNATURE----- --K4ING8H6MfWozgUW6GbtKmpuQ1TrL8nsU-- From nobody Thu Jun 20 07:07:17 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AE0C012006E for ; Thu, 20 Jun 2019 07:07:15 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.3 X-Spam-Level: X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zB2bPLptzTOc for ; Thu, 20 Jun 2019 07:07:13 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6CB4412004F for ; Thu, 20 Jun 2019 07:07:12 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id 0778EBE7B; Thu, 20 Jun 2019 15:07:10 +0100 (IST) Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4heCmcNlxUrO; Thu, 20 Jun 2019 15:07:09 +0100 (IST) Received: from [134.226.36.93] (unknown [134.226.36.93]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id A5E24BE50; Thu, 20 Jun 2019 15:07:09 +0100 (IST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1561039629; bh=XpjE3eY15pUNlfgK2IQfVnuJ4ivrgz3hN1tUfxv+ISI=; h=To:Cc:References:From:Subject:Date:In-Reply-To:From; b=0tfaB24m1/eH/ons3+fQBTMt1Yoi1pIqaTsMRvbuDqvr528BTeYZUTYx94FaQbVw3 /cZSsA1/lBCYWe8CfiAvw4JQemvXv2cZQ5iaJ7dHbvlhSAxjrIkAigC7mDRHhs/kfS hGMx90oyKae6itzIN0bzw14jAvy0qdd8Qk4dzL70= To: Eric Rescorla Cc: "tls@ietf.org" References: <73fc5d1e-12ad-db81-6f0b-702d9230a2bf@cs.tcd.ie> From: Stephen Farrell Openpgp: id=5BB5A6EA5765D2C5863CAE275AB2FAF17B172BEA; url= Autocrypt: addr=stephen.farrell@cs.tcd.ie; prefer-encrypt=mutual; keydata= mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nemCP5PMvmh 5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kTq0IqYzsEv5HI58S+ QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtEgvw4fVhVWJuyy3w//0F2tzKr EMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy+pAh4EKzS1FE7BOZp9daMu9MUQmDqtZU bUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqO Vz+7L+WiVfxLbeVqBwV+4uL9to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJg b097ZaNyuY1ETghVB5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k 4LyM2lp5FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9tlyWxn5Xi HzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQABtDJTdGVwaGVuIEZh cnJlbGwgKDIwMTcpIDxzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPokCQAQTAQgAKgIbAwUJ CZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAUCWj6jdwIZAQAKCRBasvrxexcr6o7QD/9m x9DPJetmW794RXmNTrbTJ44zc/tJbcLdRBh0KBn9OW/EaAqjDmgNJeCMyJTKr1ywaps8HGUN hLEVkc14NUpgi4/Zkrbi3DmTp25OHj6wXBS5qVMyVynTMEIjOfeFFyxG+48od+Xn7qg6LT7G rHeNf+z/r0v9+8eZ1Ip63kshQDGhhpmRMKu4Ws9ZvTW2ACXkkTFaSGYJj3yIP4R6IgwBYGMz DXFX6nS4LA1s3pcPNxOgrvCyb60AiJZTLcOk/rRrpZtXB1XQc23ZZmrlTkl2HaThL6w3YKdi Ti1NbuMeOxZqtXcUshII45sANm4HuWNTiRh93Bn5bN6ddjgsaXEZBKUBuUaPBl7gQiQJcAlS 3MmGgVS4ZoX8+VaPGpXdQVFyBMRFlOKOC5XJESt7wY0RE2C8PFm+5eywSO/P1fkl9whkMgml 3OEuIQiP2ehRt/HVLMHkoM9CPQ7t6UwdrXrvX+vBZykav8x9U9M6KTgfsXytxUl6Vx5lPMLi 2/Jrsz6Mzh/IVZa3xjhq1OLFSI/tT2ji4FkJDQbO+yYUDhcuqfakDmtWLMxecZsY6O58A/95 8Qni6Xeq+Nh7zJ7wNcQOMoDGj+24di2TX1cKLzdDMWFaWzlNP5dB5VMwS9Wqj1Z6TzKjGjru q8soqohwb2CK9B3wzFg0Bs1iBI+2RuFnxLkCDQRaPVAyARAA+g3R0HzGr/Dl34Y07XqGqzq5 SU0nXIu9u8Ynsxj7gR5qb3HgUWYEWrHW2jHOByXnvkffucf5yzwrsvw8Q8iI8CFHiTYHPpey 4yPVn6R0w/FOMcY70eTIu/k6EEFDlDbs09DtKcrsT9bmN0XoRxITlXwWTufYqUnmS+YkAuk+ TLCtUin7OdaS2uU6Ata3PLQSeM2ZsUQMmYmHPwB9rmf+q2I005AJ9Q1SPQ2KNg/8xOGxo13S VuaSqYRQdpV93RuCOzg4vuXtR+gP0KQrus/P2ZCEPvU9cXF/2MIhXgOz207lv3iE2zGyNXld /n8spvWk+0bH5Zqd9Wcba/rGcBhmX9NKKDARZqjkv/zVEP1X97w1HsNYeUFNcg2lk9zQKb4v l1jx/Uz8ukzH2QNhU4R39dbF/4AwWuSVkGW6bTxHJqGs6YimbfdQqxTzmqFwz3JP0OtXX5q/ 6D4pHwcmJwEiDNzsBLl6skPSQ0Xyq3pua/qAP8MVm+YxCxJQITqZ8qjDLzoe7s9X6FLLC/DA L9kxl5saVSfDbuI3usH/emdtn0NA9/M7nfgih92zD92sl1yQXHT6BDa8xW1j+RU4P+E0wyd7 zgB2UeYgrp2IIcfG+xX2uFG5MJQ/nYfBoiALb0+dQHNHDtFnNGY3Oe8z1M9c5aDG3/s29QbJ +w7hEKKo9YMAEQEAAYkCJQQYAQgADwUCWj1QMgIbDAUJCZQmAAAKCRBasvrxexcr6qwvD/9b Rek3kfN8Q+jGrKl8qwY8HC5s4mhdDJZI/JP2FImf5J2+d5/e8UJ4fcsT79E0/FqX3Z9wZr6h sofPqLh1/YzDsYkZDHTYSGrlWGP/I5kXwUmFnBZHzM3WGrL3S7ZmCYMdudhykxXXjq7M6Do1 oxM8JofrXGtwBTLv5wfvvygJouVCVe87Ge7mCeY5vey1eUi4zSSF1zPpR6gg64w2g4TXM5qt SwkZVOv1g475LsGlYWRuJV8TA67yp1zJI7HkNqCo8KyHX0DPOh9c+Sd9ZX4aqKfqH9HIpnCL AYEgj7vofeix7gM3kQQmwynqq32bQGQBrKJEYp2vfeO30VsVx4dzuuiC5lyjUccVmw5D72J0 FlGrfEm0kw6D1qwyBg0SAMqamKN6XDdjhNAtXIaoA2UMZK/vZGGUKbqTgDdk0fnzOyb2zvXK CiPFKqIPAqKaDHg0JHdGI3KpQdRNLLzgx083EqEc6IAwWA6jSz+6lZDV6XDgF0lYqAYIkg3+ 6OUXUv6plMlwSHquiOc/MQXHfgUP5//Ra5JuiuyCj954FD+MBKIj8eWROfnzyEnBplVHGSDI ZLzL3pvV14dcsoajdeIH45i8DxnVm64BvEFHtLNlnliMrLOrk4shfmWyUqNlzilXN2BTFVFH 4MrnagFdcFnWYp1JPh96ZKjiqBwMv/H0kw== Message-ID: <1d027d40-460a-3c28-02fd-231f411c7014@cs.tcd.ie> Date: Thu, 20 Jun 2019 15:07:08 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.7.0 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="1K0vGWORHdeKIqeO9WGPzHmBeTo9HjlCx" Archived-At: Subject: Re: [TLS] ESNI and padding X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 20 Jun 2019 14:07:16 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --1K0vGWORHdeKIqeO9WGPzHmBeTo9HjlCx Content-Type: multipart/mixed; boundary="jmQh5BxtIAjhHKxlvFDFxYBOKc8yDz5p8"; protected-headers="v1" From: Stephen Farrell To: Eric Rescorla Cc: "tls@ietf.org" Message-ID: <1d027d40-460a-3c28-02fd-231f411c7014@cs.tcd.ie> Subject: Re: [TLS] ESNI and padding References: <73fc5d1e-12ad-db81-6f0b-702d9230a2bf@cs.tcd.ie> In-Reply-To: --jmQh5BxtIAjhHKxlvFDFxYBOKc8yDz5p8 Content-Type: multipart/mixed; boundary="------------14C9BD01AE690D3D87E9EBA8" Content-Language: en-GB This is a multi-part message in MIME format. --------------14C9BD01AE690D3D87E9EBA8 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hiya, On 20/06/2019 14:48, Eric Rescorla wrote: > Again, I suppose opinions differ. Yep:-) >=20 >> As to the specific numbers in my mail - I don't much care >> what's picked, and do agree that some measurements would help >> pick good numbers. I also agree that CertificateVerify is much >> less of a concern in reality. But asking that Certificate be >> padded "such that its length equals the size of the largest >> possible Certificate (message) covered by the same ESNI key" >> would in some cases require a new database search for each >> TLS session. >=20 > I don't really know why you think that. I've come across openssl mails/github issues (I'd have to go back and find 'em again though so this is just from memory) where servers use a callback to take the SNI value and query a DB to get the private key and cert to use in the TLS session. If the current requirement is to be met, such code would need to change to figure out the max Certificate message that could be sent in order to pad as per the spec. If that code only pulls the server cert from the DB and then figures out what intermediates to also send in the Certificate message, then correctly implementing the spec could be v. hard, and likely wouldn't be done would be my guess. I'd not be surprised if they just do some other thing like read a configuration setting or something and that could be brittle as certs are updated in the DB with e.g. new X.509 extensions added. I'd imagine that servers using other libraries may well face the same issue. But just to be clear - that's not an end of the world thing, but if done badly, could leak length information, so I'd be happy if we could find a padding scheme that'd be easier to implement in a library for servers where the set of TLS server certs isn't a small static set. Hence my suggestion of padding to some multiple of M which wouldn't require any new DB lookups or config settings for that purpose. Cheers, S. --------------14C9BD01AE690D3D87E9EBA8 Content-Type: application/pgp-keys; name="0x5AB2FAF17B172BEA.asc" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="0x5AB2FAF17B172BEA.asc" -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nem CP5PMvmh5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kT q0IqYzsEv5HI58S+QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtE gvw4fVhVWJuyy3w//0F2tzKrEMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy +pAh4EKzS1FE7BOZp9daMu9MUQmDqtZUbUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5 iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqOVz+7L+WiVfxLbeVqBwV+4uL9 to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJgb097ZaNyuY1ETghV B5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k4LyM2lp5 FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9t lyWxn5XiHzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQAB tCFTdGVwaGVuIEZhcnJlbGwgPHN0ZXBoZW5AamVsbC5pZT6JAj0EEwEIACcFAlo9 UYwCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQWrL68XsXK+qG CxAApYHWYgGOIL3G6/OpkejdAkQoCVQAK8LJUSf6vzwost4iVfxIKcKW/3RqKNKk rRl8beJ7j1CWXAz9+VXAOsE9+zNxXIDgGA7HlvJnhffl+qwibVgiHgUcJFhCSbBr sjC+1uULaTU8zYEyET//GOGPLF+X+degkE/sesh4zcEAjF7fGPnlncdCCH3tvPZZ sdTcjwOCRVonKsDgQzBTCMz/RPBfEFX44HZx4g1UQAcCA4xlucY8QkJEyCrSNGpG nvGK8DcGSmnstl1/a9fnlhpdFxieX3oY2phJ1WKkYTn6Advrek3UP71CKxpgtPmk d3iUUz/VZa0Cv6YxQXskspRDVEvdCMYSQBtJPQ4y2+5UxVR9GIQXenwYp9AP2niv Voh+ITsDWWeWnnvYMq07rSDjq0nGdj41MJkNX+Yb2PXVyXItcj5ybE3T2+y3pSBG FEZYJGuaL4NwtBJFMOdOtBmUOPbetS2971EL3Izxb7ibOZWDwexv+8R6SWYfP1wV N3p46RyBQuXqJV8ccE11m6vtZTGSYgnLUUFZMRQYH+0hwuYe0T3AA18xDdSYsa8v ovCCd3l5S4UNzIM2PMChqGrEzKapUpZg7+8ACcxRU3b9Ihd7WYjJ+pQPCoWYKozv tEvenbNpE/govO/ED3B14e+R2yevRPjRrsN7PJzSf15fQLuJARwEEAEIAAYFAlo9 UqAACgkQLzyHNoBfjaLrSwf+MIHbFRQ4O5cmLYR5sIByWelN3SuRN/gW8rpKo9Ok Cz6An8uV/iCXy5tNMLzzi0BFl8f22DwBcC5qy9qnlIAdogWam1qWoTAoAD8veEqm uKhYrqJsCcAyNrKYmK0hP3rpHxx1LySDmKYXmw/8qtBXKHTouMm+5tSsznhykRMT AAr2p7PSaHgo+hIVaW/rKSspHjDhhZS+G9mtOZad1IH29M6G1Q1NCO0Ywe8krKLQ IAQlFxtgvOqpPOZNzeKBa/+KbE8TGgMWrkOhC8OeEM5PVzdDhlhD9kPzB/pCKDF5 DofJ/ZRqnDpbKPQ0bsW38AOig3kOc0A27awiBEw3urqR1YkCMwQQAQgAHRYhBH4X CgRchM9GDit5oBDvedn9g1MSBQJbtyScAAoJEBDvedn9g1MSI/oP/0A9J9nrnBMq Zpm857lfYWw+rshLK+tyeP4OQeOqnDFvs9jePpcyJLG3DF2r6VbVKPQq+AE6Uf5h cJBDEN6BjEhRPSbLcqG3A1cz/nNwm8rPmNp+oKhmaBBQGxwciMLmzgynsDydnjPp MyEs04zvsbsl4vrp2095o105l8KcrrxQrioFjbwveGwHQK9bxJKhx9D+gIk+MouB ur45UDKTZkMZrr9FGrtkyXCGAxvKdcNC5Oa8z9sj1rcUJfG/OpVAMWhArdlZbFUQ yoX6pU2Zb1CR2qpWAVerGSfBhmfCyStjARqaKxlftjO+Bj3Jj73Cr5eqej3qB5+V 4BCsPjr4RLvVbYUCPsRdxWc+nBLlfVYkRURu21g1hFm5KFPjgUkyo1s4vjUOY8Dy I+xLGF7f/IhUBG6l+Vswhpwu7ydalZkeFiPx5xna5NfbEYxvsIf71DvipGvIOaHv X4egWoFgm8n/9c3rcMxJtpwHPSsUt5dgLsyu6VE0IbvOAc3dN7CWJ355DVFJq9Zg 2YVf0izSpyyzJeGsgkfjW6xpmdvZxuT2UcN4BTcm6vYqueASGrb3lfhzC5gpeVsc /MoSjTS65vNWbpzONZWMZuLEFraxWJzC0JrDK3NCd0VN3kstqGkVbUIiYOnUm8Vu 4zoVMLlGWzHLIGoPRG2nRezn1YyNfyb5iQGcBBABCgAGBQJbxcflAAoJEGo7ETk8 pK1gE7QL/ApC5P68W5DrI1787WJVZv1u4t/g39vTr7Xer3UMTVQg10vpa7pmqOGh jIDzDMg3Pe3K3M7fVzfAlUA1qw6ne4RCueVoRKpubeF4AlYbMr0K6hNCPjt5uAxm bBVuejKTc6pru5rv5gKL0nDbr+Snft5xt7juBLSSimw0/41sZnkjCxo9rF/RA/v6 +uWyK171RKmsEYu8fFtw1eqUNt/Xj792TUixE3pxXheNtQtZGk/9P3W83ChhG4Fh 5EQsn0pIh9wZIAbMRLpgRKyW87fWHZC8/YH8h7afarvn9Thl5pFUldCe22mNJj6K LChn2aEHQd+PdY1GBpZEcmNEUPuovwzatM0h64hCzTm41eDqRfihZVBT7TbfXQnv 8rywa42Mk756RGzzEZcQEhwQXZcMQUfxIQQ2VyJo0zG36VdZTQF7TF/4Lz7/3cJ5 6jOIm+dwPXtu+C2wAQuD4USOLt4JWPYpqzDfHYJIND/497P9Z9SuQeahr2ez3DRB g3qsHEjBV7QyU3RlcGhlbiBGYXJyZWxsICgyMDE3KSA8c3RlcGhlbi5mYXJyZWxs QGNzLnRjZC5pZT6JAkAEEwEIACoCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwEC HgECF4AFAlo+o3cCGQEACgkQWrL68XsXK+qO0A//ZsfQzyXrZlu/eEV5jU620yeO M3P7SW3C3UQYdCgZ/TlvxGgKow5oDSXgjMiUyq9csGqbPBxlDYSxFZHNeDVKYIuP 2ZK24tw5k6duTh4+sFwUualTMlcp0zBCIzn3hRcsRvuPKHfl5+6oOi0+xqx3jX/s /69L/fvHmdSKet5LIUAxoYaZkTCruFrPWb01tgAl5JExWkhmCY98iD+EeiIMAWBj Mw1xV+p0uCwNbN6XDzcToK7wsm+tAIiWUy3DpP60a6WbVwdV0HNt2WZq5U5Jdh2k 4S+sN2CnYk4tTW7jHjsWarV3FLISCOObADZuB7ljU4kYfdwZ+WzenXY4LGlxGQSl AblGjwZe4EIkCXAJUtzJhoFUuGaF/PlWjxqV3UFRcgTERZTijguVyREre8GNERNg vDxZvuXssEjvz9X5JfcIZDIJpdzhLiEIj9noUbfx1SzB5KDPQj0O7elMHa1671/r wWcpGr/MfVPTOik4H7F8rcVJelceZTzC4tvya7M+jM4fyFWWt8Y4atTixUiP7U9o 4uBZCQ0GzvsmFA4XLqn2pA5rVizMXnGbGOjufAP/efEJ4ul3qvjYe8ye8DXEDjKA xo/tuHYtk19XCi83QzFhWls5TT+XQeVTMEvVqo9Wek8yoxo67qvLKKqIcG9givQd 8MxYNAbNYgSPtkbhZ8SJARwEEAEIAAYFAlo9UqAACgkQLzyHNoBfjaLzHAgAlWT6 NXEGtw/r1miKNGcopzvzILQ9oB8rKI9U9EL6tOf/y2V5oYee/GyQDb3ZdoPxxYYc Jf+RyiH1nMoqUIZiZJaf3bJXinDZ5+AdfE++UR2NBvqaNyC6u3r24jo1B/sagKbY tWgsYtRqHLD4IWi37MZrVyjBuF7u14Q07+uhjq6mX2O/tHpCYw/Q82tbeTRPyUf1 WQOAfD1kfBpW9PvAva5Iw9FWeXpCXRzwxnCZhYfGfqtuSw6CPBYLdbikqML6FZ7E DuTBb/8um1wK7Y9bgeIQC+CYjhYB5RXa1tDJRab2Js4luCvSR0w/CgHw26293tlv e2Q6UTrmHxP5U22DlokCPQQTAQgAJwUCWj1QMgIbAwUJCZQmAAULCQgHAgYVCAkK CwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6tJpD/4rrILH+meP07vrx8wW5eYuqCiP GYnh/CXxIF8eLrfbe5d4QRgtq+w6UeQPMyzKRIRiCoBXB2oJLBZHyxBPxZlg33dT MrEGn8QWKx2iNuz9rZMXyOSWFetuO01d/aUPd5BnbLbIyK5of8xCQlXM6KH8bc+9 gQ7edR9mfLTdvBf2FR522hg8BRBM1imKc3vO8v39+qIHHRjuiwxBBCAOhHtHRsZX ripS0uFA07dM46Oi/E8osjx6fQt/lH5z/PN+2adxYSrLSAXfr1oD3RxYNhuWgyGF L64/VCQb1YGjf0Z5MBPnWm9jgUoOY5K9eNSS0L83WeJjlF5+Q/WOgB+rb49Prm2D Feo9+S9f2V53Llz1WIspXJg6f+n9lmHE94MfQj1GAHCzI0FeL19lvM+LhD8jJSCb hrC3+yobyy/AUOs5Z3E+njjX1FF/VCVAs6iOa6i+XG+Y1hh3ir2y1kckJ5auT10M SU8GEZu9ayU4M3o3N9yxOjaoP0NuQ4MMLL/n/u4u94AeZaHPNBXn/hVfVRRmpRXt GKvJtFAEppGEYezB+bLKIm6XlpPkhnwYzleLZ7AMEco2C6QM8QPB3g3JpS3sqRhA 5rEP4lL16BmijmF+CHoPE/zwgKZbKpyVDqvIW5IDgvfIC2X4pbZDRvGIUKaGSB4+ ksZgUUnNyvfQr2p7jokCMwQQAQgAHRYhBH4XCgRchM9GDit5oBDvedn9g1MSBQJb tySbAAoJEBDvedn9g1MSeKkQAJm44jt1kwHgQgeDBKdjdvl0AjE0xVEQxriZ6lP/ l//34YT0auFfzsYIrChSpQXAEtobBAr4Ohw1Us+BZe+H5P8vm6LRuPwozC3SjwfX 4Iec8+9ot6tIVg4sbedDSgb/CCFVjsmIGcQ1P73JLJTBJ6mxYCV/gn3QC6bwDOFo 7kD9FDHCjRN8XfhHQ4Q9cYyt06uF31qG/aumgWYC9geCGgAwiHgwxNYb9GoJ0iZj CROwbYvLTcQgsVUW2bTmsVR13UVKDsdl02sRV7qcVYW6R0a3Ra8KudX+nt25H5DR Gd382KZ5W8pydsy/viTvD9z6v0ulChBYxAedIvGIClrhbxlLEPmIg4ImVOLGqsUg Vm32J95WOjEkk4PEZ12xSDBtwhSJqmJNboWlfmw43KdIbY8zNhffIO3N6O7FsdGx mqyHeLoTpqY+ySVUPpbuyW8ujnI/J//+6hdTZ9dQsEJQlWngKuWOQ5ma58MPSN88 zllsqhZAFQjNxqnkSzL6ZQ+v/jvuRRe16B80AeO55DsmbWsMv/YLLD1mSi7+Khy2 EtMBhgojWwrGMvdLN6X3mnzNJEscYyLxM9tSk+iySP2sLthK0BVgpAzBSdaf/ezI z60P+neHDzteNFf8Mn7lmgYk1amvZoJ29s5+n2HwxyRL5dVMyMdyQmntubbctfqr Z0tIiQGcBBABCgAGBQJbxcflAAoJEGo7ETk8pK1gnCYMAJY4FeIYjlIXGghFWzsB 4fYwK1+iaFpU3fSto5qcrqVtVPjXpwqczqBWeXGyQxiB0kan4OVAXydIeaP8EAuF CA7paP3s9STLJBO3KurkwyRkPW5zo0X7xVqaVToRsX2Ul98KVJoHYQD1KdezEtwl vpNwiiBr42AYR751Vm6JBVAbQXuFpB3c8bUV0OkkRxNFtL8/2PieHar58n5dntGk bPlPkztahsFqktgacIgXHX5vaT+7YeeZ1DWLOYjGO0wNhkOSeroCmxwJUikU7joB p823L7r5KfpqWTPpSCzVstQKZUGmmoE1qCswY/Ud5wvp9SccpIILkRXj0rZRtfnE 5MpL3hjmtNzfDd9qIsJtBJlSB2hZwAsVm1l+EWN9hG3tqyA43niUMy2n6q690of3 berSiQ+kvY/aC9Hx8I+bKzOV9/J2VUTqfaPZa4Uy2rVX5Q2p69n/PMj7mEer0rCL 3j9V16J9c+s0BSkXoKdtYdB0TWVhBgUybd9qtYcwHWvhP7QuU3RlcGhlbiBGYXJy ZWxsIDxzdGVwaGVuQHRvbGVyYW50bmV0d29ya3MuY29tPokCPQQTAQgAJwUCWj1R WgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6jsc EADEcB0WQEZn2AkrzDs1RhL0Lp6cZi0BigofkbcGfdhJyMSs19C0dhvncrAFClVI 6/Udw3yFtDyYtOCf2W3M3A1K6/RfEizCLzTsdFIhni9gOJLlUpXViQtgrlstjk7h qVV3Ooz4BlCqS4cG7rfqf4LQQPpTAuFUEV9I28FBUB2irqC+v4gTysIgpMw0bA1y BU9sX5jE/tRkzqnuzZrkwiobDtRFJ9qp+7O2JtcY4EsVtLAsaodJKc5cF8R4OvB1 n66vxxcgg9Eh4JNWZ47xsaCmAGo1Bcb2jIY35OtgAL7gCGLRSMKTtAaPy1/fEgIq hCljJ9x40Fkn/3r2BX21WC9HFSPFTBz2RluLRzxdgxOrkYK8EiHUPoE5b1AEzZKw 2AbeXfr57f5zYsN3IqfbQLUjMYtUN1wK3Pjb+idD972wyXMWt8uOzlI7b9Ocu+nY m2whBfJv9Pmp3QYTmPz+LB9lH65VNVUSxSXVr5iWXO3qx1HtEiGEqkporMQCTh3T 5Ud3PvMSRBFFKNs9WhJ/Lxz+SV30WLwG6dr5mQqlzAhb4Phc/zekZyXRdS/oDKrB LUucS36O//49JeyRi1QvOfxnfmIqRIAf/k3PoYJmTo5E82//r5Qj3YGlRu78ba0H Arxs+ACD6AnEHHcbswpbtVEKYzlSu0Ar0Dc7vRWM/IyQdIkBHAQQAQgABgUCWj1S oAAKCRAvPIc2gF+NosIsB/9f/29FNla3BJfGIEIDnhrqGD0i9bSa89SqBd++uG06 TQgW5wsqtNcrwn81yZTq6XE6i9VtD4GKfqC0d4KZJr9bnbeD81cI64VOdL8zJWJs 0vj5EIXCobKyX74Kb4uePUyZqwT2Q74I116u/HwA9/FXsPo5isbh4ZqD4t0VHpWk mfq1FPT9a/JPyX46qKqB2Fce/7Qy+SQP1NfkuUlbhUH/JG9aSSYvk3lznNiH41x9 M+FDlL106itXOubrl3oi2fT3fsSedq7uzt+IV0DQEeNaoQAUuwEhdB8IWOMqN2wo DjGVKJftfsSWY9ilZrnDBNDrp0vRqcx33LUMkIw4d7iBiQIzBBABCAAdFiEEfhcK BFyEz0YOK3mgEO952f2DUxIFAlu3JJwACgkQEO952f2DUxJjuw/6ApHSsVTWD4a0 H6FJ23A9Ftpy+aXZ4vYlzkSrfsn2ECrEfK3lXQh/uzwjJUDYZeB1/BQsFZtcYNQO JSSHbQ49BFRLwb1J/wBZG4bbmrkLxnNbKDKQvzxEpclkMW0Dj0J6o7kGrmzIGGrh B+JJN99AcineHRug8ZSFIERRCmigxdhAKU0BFD7P+5HNHltSL3DF1c2fFOf2JrgB KVoE+9RhMZjWNbYetFFLCkjXb5Rpay9zeMm1DxfSTGAnuOwUXW6qq4hnl5+VC/48 ceDZElLLfu7RQUZv44pkSTOWZs+iQoJiHMFHk9wPqyB2Vok1yJ2a2j27WhXrJlPw nZbgJO5RyWDG3p/eVmpl5Uuc2dsfIpR17KnAuWpghK6V+cyFncDoGCl/YG2Mvool sW08FiZh3Ej4dnJjj25TZkeFG74JJDXLvMYpJfSBGnmETv4Dhcm2xPqVMuFuL1qJ lMbVLrMo2GXeo03OzNyvbs+u8WLIaGm5hC7N1CXY8wZs4jo6OJ/expvnc07dEuws 4zT3AiWv3nIouWReRStZy9QkavDocqbyPmilcdPCYk4BsOlzpwwO74hNG7iyl0Kd AlwTxGQ7y0rJou6HYa1TmRhIEr3vKvlW+JfUUrqtjXgsuacTXo4+Ira2JUErL2cY zQMq1j4r1ZyhFnuz93s7Rsx/Nw0+0YuJAZwEEAEKAAYFAlvFx+UACgkQajsROTyk rWCJqwv+NLVPE4sD4sDA2/6Ek7UsRIUkg+S39fhqWsLc4rtw/mDunv8Un61I3K04 fZ2Ry4nF9hZM0a710UvXFbStvrzRJO3EAAcdJR9LTCd19e8UeruQbIee3YT91U4N kC9JMpecfq62/teOAU2e5P3fWYaLs5ZX7zCLwWuBcW2l3SyoljQczM85HhJ3XHm+ FnwQ6D9xRle+lvWTcuC9d1yAyUb8IOospcL2lJTmy8e3r79R24hPlSB4LDe0wEN8 AXbagrcAQZjwyaHyWxjJbTwZ0b43WGdfIqZ1ElOeoffbketPGRmWvx5xUvb2ALFB BdETzV270gs5XDJgJ1SIIKOyDADxwvroTe2jD8C/841eEql5QSow3s/U3zRqk3mt tto8Qw/DN71aeh6dmYSsvd2UjsHw/vofOPRBGxZLEkKTEvMnhmMW9hiKPkPia+Qg evYE020qpKSxLEdWA8nprHwxmGiDNesCfXSC6vm1qfyj5g8HzxSckq9ZaMhKMCo7 vxflUEDuuQINBFo9UDIBEAD6DdHQfMav8OXfhjTteoarOrlJTSdci727xiezGPuB HmpvceBRZgRasdbaMc4HJee+R9+5x/nLPCuy/DxDyIjwIUeJNgc+l7LjI9WfpHTD 8U4xxjvR5Mi7+ToQQUOUNuzT0O0pyuxP1uY3RehHEhOVfBZO59ipSeZL5iQC6T5M sK1SKfs51pLa5ToC1rc8tBJ4zZmxRAyZiYc/AH2uZ/6rYjTTkAn1DVI9DYo2D/zE 4bGjXdJW5pKphFB2lX3dG4I7ODi+5e1H6A/QpCu6z8/ZkIQ+9T1xcX/YwiFeA7Pb TuW/eITbMbI1eV3+fyym9aT7Rsflmp31Zxtr+sZwGGZf00ooMBFmqOS//NUQ/Vf3 vDUew1h5QU1yDaWT3NApvi+XWPH9TPy6TMfZA2FThHf11sX/gDBa5JWQZbptPEcm oazpiKZt91CrFPOaoXDPck/Q61dfmr/oPikfByYnASIM3OwEuXqyQ9JDRfKrem5r +oA/wxWb5jELElAhOpnyqMMvOh7uz1foUssL8MAv2TGXmxpVJ8Nu4je6wf96Z22f Q0D38zud+CKH3bMP3ayXXJBcdPoENrzFbWP5FTg/4TTDJ3vOAHZR5iCunYghx8b7 Ffa4UbkwlD+dh8GiIAtvT51Ac0cO0Wc0Zjc57zPUz1zloMbf+zb1Bsn7DuEQoqj1 gwARAQABiQIlBBgBCAAPBQJaPVAyAhsMBQkJlCYAAAoJEFqy+vF7FyvqrC8P/1tF 6TeR83xD6MasqXyrBjwcLmziaF0Mlkj8k/YUiZ/knb53n97xQnh9yxPv0TT8Wpfd n3BmvqGyh8+ouHX9jMOxiRkMdNhIauVYY/8jmRfBSYWcFkfMzdYasvdLtmYJgx25 2HKTFdeOrszoOjWjEzwmh+tca3AFMu/nB++/KAmi5UJV7zsZ7uYJ5jm97LV5SLjN JIXXM+lHqCDrjDaDhNczmq1LCRlU6/WDjvkuwaVhZG4lXxMDrvKnXMkjseQ2oKjw rIdfQM86H1z5J31lfhqop+of0cimcIsBgSCPu+h96LHuAzeRBCbDKeqrfZtAZAGs okRina9947fRWxXHh3O66ILmXKNRxxWbDkPvYnQWUat8SbSTDoPWrDIGDRIAypqY o3pcN2OE0C1chqgDZQxkr+9kYZQpupOAN2TR+fM7JvbO9coKI8Uqog8CopoMeDQk d0YjcqlB1E0svODHTzcSoRzogDBYDqNLP7qVkNXpcOAXSVioBgiSDf7o5RdS/qmU yXBIeq6I5z8xBcd+BQ/n/9Frkm6K7IKP3ngUP4wEoiPx5ZE5+fPIScGmVUcZIMhk vMvem9XXh1yyhqN14gfjmLwPGdWbrgG8QUe0s2WeWIyss6uTiyF+ZbJSo2XOKVc3 YFMVUUfgyudqAV1wWdZinUk+H3pkqOKoHAy/8fST =3DYzQY -----END PGP PUBLIC KEY BLOCK----- --------------14C9BD01AE690D3D87E9EBA8-- --jmQh5BxtIAjhHKxlvFDFxYBOKc8yDz5p8-- --1K0vGWORHdeKIqeO9WGPzHmBeTo9HjlCx Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEW7Wm6ldl0sWGPK4nWrL68XsXK+oFAl0Lkw0ACgkQWrL68XsX K+pYHRAAzmG9b/ZXQxBywuF4p7XsUyg02hE2netDuqzZFIpfjBLA+auRAvww8vm/ uQqN/6G+BHa/Qc83bOeuQwLONhZhjlFr+0udDt6qzXHcfc6vFVTfoGRSJaqARyBv nSHerfSORVcfKes9vsb10y+9DNMOaF5Yyl6tSZHJVsiWvvEti9r583rB4XMUObeH QbOmrLlFZVa7Z3meUScazAuZ9pUUhTdw0jH55TfJl4NGZ2pvVeuirUNdIDwNE5mR 6Ns6P4FpNKZfIZm0t4ztng4jTJ8U1QJlTJY11/sErsiIWDdoCMJ8Yxia401Imcwv pV9twFydKWfesaEVre1HdAuQHBVh6W2mENkZHPiO2+Z+M5aXfuhGzUtLF09aPN7K SlxSEItA9j3j6iHFo2D4TYiXvh6FWF3bWfKTeOKd3/KxOYEoFMBRnYMBikJhNaxr rpA5Po6K/6rxnCfM2l6GbqiAih4dADxvrizLjavNBxOeu0CMefAkVheM2FEZG70S O4UFZYgBLUNwONMaMd5ZPmqYn2Yz4bUajzNFTwIRFAGS+c1+84CQSw5PbF2DBoHL emf//3FaR4NwJR8HlMiGG+YCHRNfBDtAWwJhAQmUCBLhmU3zFIf444icVBv99BMH kFU2EUDEujQVmd38n3EIp1T+hF2xoEs3IrPm9NM0+YcOoRlNV1k= =PxFY -----END PGP SIGNATURE----- --1K0vGWORHdeKIqeO9WGPzHmBeTo9HjlCx-- From nobody Thu Jun 20 07:59:43 2019 Return-Path: X-Original-To: tls@ietf.org Delivered-To: tls@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id C4A851200E3; Thu, 20 Jun 2019 07:59:41 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: Cc: tls@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.98.0 Auto-Submitted: auto-generated Precedence: bulk Reply-To: tls@ietf.org Message-ID: <156104278170.3039.3751275110690891117@ietfa.amsl.com> Date: Thu, 20 Jun 2019 07:59:41 -0700 Archived-At: Subject: [TLS] I-D Action: draft-ietf-tls-oldversions-deprecate-05.txt X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 20 Jun 2019 14:59:42 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Transport Layer Security WG of the IETF. Title : Deprecating TLSv1.0 and TLSv1.1 Authors : Kathleen Moriarty Stephen Farrell Filename : draft-ietf-tls-oldversions-deprecate-05.txt Pages : 22 Date : 2019-06-20 Abstract: This document, if approved, formally deprecates Transport Layer Security (TLS) versions 1.0 [RFC2246] and 1.1 [RFC4346] and moves these documents to the historic state. These versions lack support for current and recommended cipher suites, and various government and industry profiles of applications using TLS now mandate avoiding these old TLS versions. TLSv1.2 has been the recommended version for IETF protocols since 2008, providing sufficient time to transition away from older versions. Products having to support older versions increase the attack surface unnecessarily and increase opportunities for misconfigurations. Supporting these older versions also requires additional effort for library and product maintenance. This document also deprecates Datagram TLS (DTLS) version 1.0 [RFC6347] (but not DTLS version 1.2, and there is no DTLS version 1.1). This document updates many RFCs that normatively refer to TLSv1.0 or TLSv1.1 as described herein. This document also updates RFC 7525 and hence is part of BCP195. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-tls-oldversions-deprecate/ There are also htmlized versions available at: https://tools.ietf.org/html/draft-ietf-tls-oldversions-deprecate-05 https://datatracker.ietf.org/doc/html/draft-ietf-tls-oldversions-deprecate-05 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-tls-oldversions-deprecate-05 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Thu Jun 20 18:46:49 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B20EC12015C for ; Thu, 20 Jun 2019 18:46:47 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=sn3rd.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TxOS8EGMCmzu for ; Thu, 20 Jun 2019 18:46:46 -0700 (PDT) Received: from mail-qk1-x733.google.com (mail-qk1-x733.google.com [IPv6:2607:f8b0:4864:20::733]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0B4451200FD for ; Thu, 20 Jun 2019 18:46:46 -0700 (PDT) Received: by mail-qk1-x733.google.com with SMTP id b18so3310177qkc.9 for ; Thu, 20 Jun 2019 18:46:45 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sn3rd.com; s=google; h=from:content-transfer-encoding:mime-version:subject:message-id:date :to; bh=QuZB7t1FSKs+JwbFNK0yg0k2TMftWwPxSTRj6DfdPfA=; b=i1yuFyTaL+69GSvWccQIKpKC+ZF6mgqLlbJnL79foI1aXBsY0UWWDUu9VIUPwFKSil GDHDbPtY2qBdz9Z9W5PK3ynyukVvl/gfoL4nSYe+fjL4M663w0tUsQjD/siXl0oWpFPL glNNKBaj9YbxZhnzeFFvBliBr8awoCB+QBSxs= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:content-transfer-encoding:mime-version :subject:message-id:date:to; bh=QuZB7t1FSKs+JwbFNK0yg0k2TMftWwPxSTRj6DfdPfA=; b=VpQKwEPMeKCjH79OOV72Nd4wILbjKyuHN0HH+XNWVhCjTjtC7QEtXzGtMCoJb4CdIU gMmXrRaOftYCiyJiUHrgfcmYf6+hhwa29J3B7mHLDAZ6A/b9u+OBqJTfq6yFkvWHb2PF G6d+BNKkIuQXqW/cHzRz7nnSFFg9uQWSLBN9wJ3ounyQLTtmIVgp44442hOestkTZ9ww rKp/J8w+kuEL9v34gtw44TobK6NU2osuCnaImDgd2yeWwiynRGZ1KVJqTftSxxFXNFIk 2zj1Zmt+QpQO9SaYgTRW0mkIasCn4bYWqoAm7whQWoXSb6a3dIgsxvBo6eXOtlNg7wlS qUPQ== X-Gm-Message-State: APjAAAXE43DN7dkfjvppjA7DgxWScQtAjRzKL0UY8eT8uiOqByrVX2Z/ ZvWeAJ//PaGbC99yh08gV12JboUZf9s= X-Google-Smtp-Source: APXvYqyh72ywBdKRpKnrdFHM/DUbaQFRtrEGqdkn99YpYjHa/vWHf6pWBt+DHEuKREV8Mt9RyGiJiw== X-Received: by 2002:a37:86c4:: with SMTP id i187mr3683060qkd.464.1561081605114; Thu, 20 Jun 2019 18:46:45 -0700 (PDT) Received: from sn3rd.lan ([75.102.131.36]) by smtp.gmail.com with ESMTPSA id q2sm726590qkf.44.2019.06.20.18.46.44 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 20 Jun 2019 18:46:44 -0700 (PDT) From: Sean Turner Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Message-Id: Date: Thu, 20 Jun 2019 21:46:43 -0400 To: TLS List X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: [TLS] IANA Considerations for draft-ietf-tls-dtls-connection-id X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 21 Jun 2019 01:46:48 -0000 All, During the DE=E2=80=99s review of the assignments for = draft-ietf-tls-dtls-connection-id, they requested a new =E2=80=9CDTLS = Only=E2=80=9D column be added to the TLS ExtensionType Values registry. = This connection_id would be the only =E2=80=9CY=E2=80=9D and all others = there now would be =E2=80=9CN=E2=80=9D. The chairs also noted that the IANA considerations in = draft-ietf-tls-dtls-connection-id needs to specify values for all the = columns for connection_id in the TLS ExtensionType Values registry and = tls12_cid in the TLS ContentType registry. Here are the proposed = values: connection_id TLS 1.3 column: =E2=80=9C-=E2=80=9C it is not applicable to TLS = 1.3 Recommended: =E2=80=9CY" tls12_cid DTLS-OK: =E2=80=9CY=E2=80=9D This has been captured in the following PR: https://github.com/tlswg/dtls-conn-id/pull/67 Obviously, please comment. spt= From nobody Thu Jun 20 18:47:24 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 044961201BB for ; Thu, 20 Jun 2019 18:47:16 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=sn3rd.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id uNr9G6Uy2O3O for ; Thu, 20 Jun 2019 18:47:14 -0700 (PDT) Received: from mail-qk1-x72c.google.com (mail-qk1-x72c.google.com [IPv6:2607:f8b0:4864:20::72c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 140391201CB for ; Thu, 20 Jun 2019 18:47:14 -0700 (PDT) Received: by mail-qk1-x72c.google.com with SMTP id i125so3328580qkd.6 for ; Thu, 20 Jun 2019 18:47:14 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sn3rd.com; s=google; h=from:content-transfer-encoding:mime-version:subject:date:references :to:in-reply-to:message-id; bh=PT9NgU6/0v9FuTRD4mnC57cfd3AQvMIRYwC3mc/fkFY=; b=YXNt//aWPBWuqRbsw6kAdDOqFbku57sgi7FAGKOUpUvmMCIvrbq/yeSrlUuS5JNTO4 Tn7sM/GMg2sV5RDiVGGIt86Mpz07e4v2GOd79xQgvfZRuO8ZHFgDdt16fu00S2qt2/bB nghCYeOWgl9xI43jGC1rOtsWaU+iGxCFiShMQ= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:content-transfer-encoding:mime-version :subject:date:references:to:in-reply-to:message-id; bh=PT9NgU6/0v9FuTRD4mnC57cfd3AQvMIRYwC3mc/fkFY=; b=U0nbgcCLW8VqMokw3fb8Mx8th27xzhiHgNdaasIctAt5g9Wvh6myQbVdCyNZTL2Kkf IUSMjUZOEuviOZbKgxYfMbJB5J6ynbdMboZB7Sn/ZyGQUJC0teRXIzzmGZKsyXX+mZCJ JG1S0e2w7tEnAc183L6Lio8RyGZsLVTXv1xTwvQBBkft0xMWHb7RhX3TigcmRbAY0OCM ZPXJu+pAtey0Pw95PczXyBHHIutUqUy7WrhuuQeGW0AcuVoGWoJwr2ry5mIY6ZY/WXNH gtT4sZGZI19DJGRCpFGKZgOFsfU8jUcusHArYHQtMKGALUGqzABdJwmBOVS+HpIz60NX dU9A== X-Gm-Message-State: APjAAAXDIFE/zdQxz8CG5zo4ymSW1ucq9YLj547tCIRbO7qV7NyIcvGx ZSNE8DpbdrjxleYkzE1PHX/7WA/QDn4= X-Google-Smtp-Source: APXvYqzphRjhpd7NlmKIMudWi3VtMl9xsTHj+20QVXnSNG1XxKB0nY8YscwunAeho4ZeXO8i1b0Wpg== X-Received: by 2002:ae9:ee14:: with SMTP id i20mr3268248qkg.428.1561081633095; Thu, 20 Jun 2019 18:47:13 -0700 (PDT) Received: from sn3rd.lan ([75.102.131.36]) by smtp.gmail.com with ESMTPSA id q2sm726590qkf.44.2019.06.20.18.47.12 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 20 Jun 2019 18:47:12 -0700 (PDT) From: Sean Turner Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: quoted-printable Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Thu, 20 Jun 2019 21:47:12 -0400 References: To: TLS List In-Reply-To: Message-Id: <0D2FCE57-8997-41DA-A10B-1DF1A3B172C2@sn3rd.com> X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [TLS] TLS@IETF105: Agenda Topics X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 21 Jun 2019 01:47:24 -0000 Just a reminder ... > On Jun 6, 2019, at 12:59, Sean Turner wrote: >=20 > The TLS WG will be meeting @ IETF 105 in Montreal. To help the chairs = get a better handle on how much time we will need for our session, = please send in your agenda requests to tls-chairs@ietf.org. Along with = your request please provide an estimate for how much time you will need. >=20 > Please also review the Guidance for TLS WG presenters that can be = found at [0]. >=20 > Cheers, >=20 > Chris, Joe, and Sean >=20 > [0] https://github.com/tlswg/tlswg-wiki/blob/master/FAQ.md From yishuai@upenn.edu Sun Jun 23 19:48:57 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2FB7B1202C0 for ; Sun, 23 Jun 2019 19:48:57 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.273 X-Spam-Level: X-Spam-Status: No, score=0.273 tagged_above=-999 required=5 tests=[RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_SOFTFAIL=0.972] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WpG1G2A2yYwY for ; Sun, 23 Jun 2019 19:48:56 -0700 (PDT) Received: from mx0b-000c2a01.pphosted.com (mx0b-000c2a01.pphosted.com [148.163.155.36]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A753F1202CE for ; Sun, 23 Jun 2019 19:48:55 -0700 (PDT) Received: from pps.filterd (m0128480.ppops.net [127.0.0.1]) by mx0b-000c2a01.pphosted.com (8.16.0.42/8.16.0.42) with SMTP id x5O2i5oR014409 for ; Sun, 23 Jun 2019 22:48:54 -0400 Received: from hound.seas.upenn.edu (coyote.seas.upenn.edu [158.130.71.130]) by mx0b-000c2a01.pphosted.com with ESMTP id 2t9j0f3tkf-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Sun, 23 Jun 2019 22:48:54 -0400 Received: from mail-io1-f42.google.com (mail-io1-f42.google.com [209.85.166.42]) (authenticated bits=0) by hound.seas.upenn.edu (8.15.2/8.15.2) with ESMTPSA id x5O2mrOx027000 (version=TLSv1.2 cipher=AES256-GCM-SHA384 bits=256 verify=NOT) for ; Sun, 23 Jun 2019 22:48:54 -0400 Received: by mail-io1-f42.google.com with SMTP id w25so711290ioc.8 for ; Sun, 23 Jun 2019 19:48:54 -0700 (PDT) X-Gm-Message-State: APjAAAUXz0ZW76TSE+3JLfRDKVKDHpRSt9fhzostHmjoU2e1gUwirhk0 9lzBe/SUS3K8EhUojkbdhed4U/zCulGvwtjuw2HN X-Google-Smtp-Source: APXvYqwT6V+eFKJwlP4U/6Hg18FaeNLukyqyqs9x24GI205/u4H/6JnAhd6lYCEmo0docZL8m5Y86oIlwU9pEBeMXk8= X-Received: by 2002:a05:6638:29a:: with SMTP id c26mr18127187jaq.98.1561344528623; Sun, 23 Jun 2019 19:48:48 -0700 (PDT) MIME-Version: 1.0 From: Yishuai Li Date: Sun, 23 Jun 2019 22:48:05 -0400 X-Gmail-Original-Message-ID: Message-ID: To: tls@ietf.org Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:5.22.46,1.0.8 definitions=2019-06-24_02:2019-06-22,2019-06-24 signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 clxscore=1011 phishscore=0 mlxlogscore=999 mlxscore=0 bulkscore=0 adultscore=0 malwarescore=0 suspectscore=3 impostorscore=0 lowpriorityscore=0 spamscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-1904300001 definitions=main-1906240021 Archived-At: Subject: [TLS] Inconsistent extension definitions X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 24 Jun 2019 02:51:24 -0000 Dear TLS working group, Here=E2=80=99s a duplicate of GitHub issue tlswg/tls13-rfc#21 I opened toda= y, which somehow disappeared: Supported Versions are defined as Variants: struct { select (Handshake.msg_type) { case client_hello: ProtocolVersion versions<2..254>; case server_hello: /* and HelloRetryRequest */ ProtocolVersion selected_version; }; } SupportedVersions; while Key Share is defined as separate Constructed Types: struct { KeyShareEntry client_shares<0..2^16-1>; } KeyShareClientHello; struct { NamedGroup selected_group; } KeyShareHelloRetryRequest; struct { KeyShareEntry server_share; } KeyShareServerHello; Is there a specific reason for choosing different definition styles? Is it worth unifying them? Also, is this mailing list the right place for such questions? Thanks, Yishuai Li From nobody Mon Jun 24 10:53:07 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 560331206ED for ; Mon, 24 Jun 2019 10:53:05 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FawbBlz9oa-A for ; Mon, 24 Jun 2019 10:53:03 -0700 (PDT) Received: from mail-lj1-x22f.google.com (mail-lj1-x22f.google.com [IPv6:2a00:1450:4864:20::22f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0E2FB12016A for ; Mon, 24 Jun 2019 10:53:03 -0700 (PDT) Received: by mail-lj1-x22f.google.com with SMTP id k18so13461463ljc.11 for ; Mon, 24 Jun 2019 10:53:02 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=jQG0APDV3q0dG0cqlpynCGdrK5ADHLbK/PIt9j6aMS0=; b=RLQ/gnSrY83muIBZBubL5DeCBFj+28AQ3/JmMyM3fUb5XlVJpIXOSNJTo5MqcOsg1u /tbbrLalb0l8DmPvjyRVdVyGjmdv1Ft2vQRrcg6YZ045z5JBK4H997eiALnEmcrlOsq2 lWaxzrH773h7CqXyK7KgiWKNb3oNRQnHuRQD2Z7lhhmZX9PMIRVTUKdSZdgJevlbbMLG jYZh/fB2Q+i41FwdU85YgJ4VGB5w1kFaxebl1OoXGubEKfX2BUfM0uDXZwOrs3sQyjQT 3RSXZrUyEl6jRZjDDBx3MZ+jywg8QeCtElWLNB9JIi3lOw+JthhDa3g226E9AS5OrUnz 8zEQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=jQG0APDV3q0dG0cqlpynCGdrK5ADHLbK/PIt9j6aMS0=; b=gaWH7Po6hqrwIbb2VGXYJ87STrhE8z/PSEPs5RZzHQEeU91XaUdsbQMqPqgP38GgCT f1QGrHV6UsGtKpgRi5zFRl5t5kGRmpYVT5irvxVJASm5x3ned/RdAAZsgne3nMU+ZqQl BUd0tf+9WICInWyphGXdWnI4cH9bzAZuXilpCxoem2v0FE3zB7ALaGkIEJPC5/wL28N1 cikITAWJk7QQqkBsZVi1LuoPuB8Y3KviVSJjGoXbEX9V34Tnhzo2eO2fGQMYFYrmR2gy et6Qjisz7EK1UN7YDX1aogH8SePcciRpMArWvXSq0DCO5mGDkaI6cNGZjPXtgfGMAewi 3Wdw== X-Gm-Message-State: APjAAAW70kHeXMZNfnnVPy6pxXZC31xpOdYGRoonT2IZNRaYJxAkAWit fq7I4xWWmp/CdbDggTVkR3maryyO9gsJvLyKZTh+ig== X-Google-Smtp-Source: APXvYqwTkyVex8VmhzGw99yww7U2RXR5Q6K4zYy8QCtG1dma6naIzoff3F5eT3Qqvdm8m+4iNFcN7r3OrdAUJf54UnQ= X-Received: by 2002:a2e:96d0:: with SMTP id d16mr71831056ljj.14.1561398781217; Mon, 24 Jun 2019 10:53:01 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Eric Rescorla Date: Mon, 24 Jun 2019 10:52:23 -0700 Message-ID: To: Yishuai Li Cc: "" Content-Type: multipart/alternative; boundary="000000000000b51ee7058c157b28" Archived-At: Subject: Re: [TLS] Inconsistent extension definitions X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 24 Jun 2019 17:53:05 -0000 --000000000000b51ee7058c157b28 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Sun, Jun 23, 2019 at 7:51 PM Yishuai Li wrote: > Dear TLS working group, > > Here=E2=80=99s a duplicate of GitHub issue tlswg/tls13-rfc#21 I opened to= day, > which somehow disappeared: > I closed it. The RFC has been published, so filing issues on that repo isn't useful. Supported Versions are defined as Variants: > > struct { > select (Handshake.msg_type) { > case client_hello: > ProtocolVersion versions<2..254>; > > case server_hello: /* and HelloRetryRequest */ > ProtocolVersion selected_version; > }; > } SupportedVersions; > > while Key Share is defined as separate Constructed Types: > > struct { > KeyShareEntry client_shares<0..2^16-1>; > } KeyShareClientHello; > > struct { > NamedGroup selected_group; > } KeyShareHelloRetryRequest; > > struct { > KeyShareEntry server_share; > } KeyShareServerHello; > > Is there a specific reason for choosing different definition styles? > I'm not aware of any specific reason. I think it's just an inconsistency, perhaps due to aesthetics. The protocol is the same eithere way. Is it worth unifying them? > Probably not. It's editorial and there is no real mechanism for doing that, given that the RFC has been published. -Ekr > Also, is this mailing list the right place for such questions? > > Thanks, > Yishuai Li > > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls > --000000000000b51ee7058c157b28 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Sun, Jun 23, 2019 at 7:51 PM Yishu= ai Li <yishuai@upenn.edu> wr= ote:
Dear TLS wo= rking group,

Here=E2=80=99s a duplicate of GitHub issue tlswg/tls13-rfc#21 I opened toda= y,
which somehow disappeared:

I closed it.= The RFC has been published, so filing issues on that repo isn't useful= .


Supported Versions are defined as Variants:

=C2=A0 =C2=A0 struct {
=C2=A0 =C2=A0 =C2=A0 =C2=A0 select (Handshake.msg_type) {
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 case client_hello:
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0ProtocolVersi= on versions<2..254>;

=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 case server_hello: /* and HelloRe= tryRequest */
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0ProtocolVersi= on selected_version;
=C2=A0 =C2=A0 =C2=A0 =C2=A0 };
=C2=A0 =C2=A0 } SupportedVersions;

while Key Share is defined as separate Constructed Types:

=C2=A0 =C2=A0 struct {
=C2=A0 =C2=A0 =C2=A0 =C2=A0 KeyShareEntry client_shares<0..2^16-1>; =C2=A0 =C2=A0 } KeyShareClientHello;

=C2=A0 =C2=A0 struct {
=C2=A0 =C2=A0 =C2=A0 =C2=A0 NamedGroup selected_group;
=C2=A0 =C2=A0 } KeyShareHelloRetryRequest;

=C2=A0 =C2=A0 struct {
=C2=A0 =C2=A0 =C2=A0 =C2=A0 KeyShareEntry server_share;
=C2=A0 =C2=A0 } KeyShareServerHello;

Is there a specific reason for choosing different definition styles?

I'm not aware of any specific reason. I t= hink it's just an inconsistency, perhaps due to aesthetics.
<= br>
The protocol is the same eithere way.


Is it worth unifying them?

Probably not= . It's editorial and there is no real mechanism for doing that, given t= hat the RFC has been published.

-Ekr




Also, is this mailing list the right place for such questions?

Thanks,
Yishuai Li

_______________________________________________
TLS mailing list
TLS@ietf.org
https://www.ietf.org/mailman/listinfo/tls
--000000000000b51ee7058c157b28-- From nobody Tue Jun 25 13:49:20 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 95EE5120499 for ; Tue, 25 Jun 2019 13:49:12 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=heapingbits.net header.b=G9zFth5X; dkim=pass (2048-bit key) header.d=messagingengine.com header.b=YpExTVwT Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id LEWE-uKEfk0l for ; Tue, 25 Jun 2019 13:49:09 -0700 (PDT) Received: from out2-smtp.messagingengine.com (out2-smtp.messagingengine.com [66.111.4.26]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 341221204AA for ; Tue, 25 Jun 2019 13:49:07 -0700 (PDT) Received: from compute6.internal (compute6.nyi.internal [10.202.2.46]) by mailout.nyi.internal (Postfix) with ESMTP id 438B322087 for ; Tue, 25 Jun 2019 16:49:06 -0400 (EDT) Received: from imap4 ([10.202.2.54]) by compute6.internal (MEProxy); Tue, 25 Jun 2019 16:49:06 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=heapingbits.net; h=mime-version:message-id:in-reply-to:references:date:from:to :subject:content-type; s=fm1; bh=XGDQOXzNVNC1mtliIwBl7aomy1kbgiC YVl/lhSRZC9M=; b=G9zFth5XYOgSkHF/lDpama1I89UgL8Y+LkdzSYiuloTeAar 8glICson+O3aGPQrhRbDjq6wVDDi9gEHlAYUVc+oZTeKsoOk+NPGQPR7v9xOkFnu 6+Yv3w+8prjSIfbBgzdky+ccbwC4ZBP7FgZHB8dldOZP07Ab7f83yWxiNmB0JJsN Tpg9zMlvSwRJkc/MHsavAXLZLusQ9fHhzhnpBIxftZ4bThQGHaoaOgo2y9pyUsdC LdvjWfhhDUoKHUNQ5eQ309C4unaJvMjh03+IGB+/0YY0l1uYPb8siqWx6Xf53Tpv pz0bgs2VM2m4AsCyeGrUnMhRRrSrXPkNEcontMg== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to:x-me-proxy :x-me-proxy:x-me-sender:x-me-sender:x-sasl-enc; s=fm3; bh=XGDQOX zNVNC1mtliIwBl7aomy1kbgiCYVl/lhSRZC9M=; b=YpExTVwTXNAuuaxTJBUT1S FcnZJzfXVgraLIEcMltbQEO1uthfSWhVguTMrNrNoYDolAJcf9KZ6PccC7/sk4IA XBgoc8Frnqol8dl47tQ1rR1sepIqz+eiNYGH3/r5qWib3Xz2ZdD/LAQ/qAUpsRYL xemIR5DDPR156Ha/cAGsNCkHyT9rxrDllghzxImsgkBGcBHHe4PWhWgmHjP76J31 iVRTJJZ6AwIDMM6jXGZzSrs3SuurBzKBwW6H5cDNmwm05xnPkm4nDxUscrl1klvj MOTpiZ4feVRrCuxvASQcCvnfHhRQkFczjwPc1Q1FHo8fbu5o+J6O4bOS49iMqkDA == X-ME-Sender: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgeduvddrudeggdduheefucetufdoteggodetrfdotf fvucfrrhhofhhilhgvmecuhfgrshhtofgrihhlpdfqfgfvpdfurfetoffkrfgpnffqhgen uceurghilhhouhhtmecufedttdenucenucfjughrpefofgggkfgjfhffhffvufgtsehttd ertderredtnecuhfhrohhmpedfvehhrhhishhtohhphhgvrhcuhghoohgufdcuoegtrgif sehhvggrphhinhhgsghithhsrdhnvghtqeenucfrrghrrghmpehmrghilhhfrhhomheptg grfieshhgvrghpihhnghgsihhtshdrnhgvthenucevlhhushhtvghrufhiiigvpedt X-ME-Proxy: Received: by mailuser.nyi.internal (Postfix, from userid 501) id DD0B53C00A2; Tue, 25 Jun 2019 16:49:05 -0400 (EDT) X-Mailer: MessagingEngine.com Webmail Interface User-Agent: Cyrus-JMAP/3.1.6-730-g63f2c3b-fmstable-20190622v1 Mime-Version: 1.0 Message-Id: <9a94a3ec-062f-480c-b98b-a8d2f704ae50@www.fastmail.com> In-Reply-To: References: <65bae8fa-36b1-4724-4107-2e0e02a6adc6@cs.tcd.ie> Date: Tue, 25 Jun 2019 13:49:05 -0700 From: "Christopher Wood" To: "TLS@ietf.org" Content-Type: text/plain Archived-At: Subject: Re: [TLS] ESNI and padding X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 25 Jun 2019 20:49:19 -0000 On Thu, Jun 20, 2019, at 6:16 AM, Ben Schwartz wrote: > > > On Thu, Jun 20, 2019 at 8:04 AM Stephen Farrell > wrote: > > > > Hiya, > > > > On 20/06/2019 12:20, Ben Schwartz wrote: > > > > > > As you are clearly aware, this approach provides essentially no privacy > > > protection in the case where a user is repeatedly connecting to a very long > > > domain on a server whose other domains are reasonably short. > > > > Yep. I don't believe that that's at all a common scenario, > > but if I'm wrong then sure, the approach I outlined wouldn't > > be a good plan, at least not with N=32, but maybe some other > > N would work fine. Do we know how common very long SNI names > > are? (I don't.) > > > > If we think that scenario is a real problem, that can't be > > sufficiently mitigated via picking a good N, then I guess > > always having padding_length==260 would be the only answer. > > In which case I see no upside and some downsides in having > > that field in ESNIkeys. > > > > > Rather than make a privacy-vs-efficiency tradeoff in the spec, the current > > > text leaves this option to the implementer. For example, within the > > > current protocol (albeit bending the recommendations slightly), an > > > implementer could easily bucket names by length, and offer separate > > > ESNIKeys for each length bucket. I think this is preferable; only the > > > server operator knows their own privacy and efficiency goals. In my view, > > > setting N=32 for the first bucket would reproduce most of the benefits of > > > this proposal without altering the current protocol. > > > > Fair point. OTOH, if you did that, the last (or maybe even > > all but the first) bucket would likely mean an ESNIKey used > > for very few names, so you end up with the same issue you > > called out above. And it adds some more complexity to what's > > an already complicated thing. So while that could always > > be done, and with the current spec, I'd not be keen to > > recommend it myself. > > > > I just looked back at RFC8467 which recommends padding DNS > > queries to a multiple of 128 octets. I also looked at a couple > > of DNS queries on my laptop just now and there seems to be > > about 40 octets overhead over and above the qname length > > (each "." adds two octets in the encoded length vs. the > > string length it seems). So one could I guess argue for some > > commensurate amount of padding in the ESNI extension and > > whatever was used for DoT or DoH. I wonder if the data DKG > > used to generate that recommendation in 8467 might tell us > > anything here? > > I've implemented RFC 8467 myself, and I'm grateful for the > recommendation, but I think it's rightly marked Experimental. It's not > clear how to judge the amount of privacy protection it offers, or > whether it's truly a good balance between privacy and efficiency. > > However, as a matter of overhead, your test suggests that RFC 8467 > roughly doubles the size of each query packet. That's similar to the > proportional effect of maximum ESNI padding on a typical ClientHello. > Proportionally, I expect RFC 8467 adds more padding to the whole DNS > transaction than current ESNI adds to the whole TLS handshake. It might > even be true in absolute terms, on average. In the context of a full > TLS connection, the proportional impact of ESNI is even smaller. > > > Again though, I think considering DNS query padding argues > > that this ought be a client-driven thing and not tied to the > > ESNIKeys. > One important difference between these cases is that DNS is essentially > an "open world", where no one knows the whole space of possibilities, > whereas a specific server is a "closed world", a finite set of domains > (known only to the server operator). That puts the server operator in > the unique position to make correct padding decisions, and also makes > the adversary's job much easier if the padding is incorrect. +1 -- I don't think we ought to change the current text. Best, Chris (no hat) From nobody Wed Jun 26 03:21:00 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 47550120280 for ; Wed, 26 Jun 2019 03:20:58 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.3 X-Spam-Level: X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 795AC8KtwV_a for ; Wed, 26 Jun 2019 03:20:55 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DE79F120077 for ; Wed, 26 Jun 2019 03:20:54 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id 768ABBE24 for ; Wed, 26 Jun 2019 11:20:52 +0100 (IST) Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6-GkFicBbM_l for ; Wed, 26 Jun 2019 11:20:52 +0100 (IST) Received: from [134.226.36.93] (unknown [134.226.36.93]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id 2F976BE20 for ; Wed, 26 Jun 2019 11:20:52 +0100 (IST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1561544452; bh=WmsDU1FuAz4PTGRZqvtyjeTyUvHdi7UH9wTmDwRHDKc=; h=To:From:Subject:Date:From; b=Vadoi8W0NLdk/YN5wh2cg0EhWYVn3IGUqe6cj1cMq4+ic+h7fwhw9vsepQ99zWhXA kSu+TTWwy36dhjDiNw/1x6XzxpEEywes5BWvMVNG+hmX9keycjTTl9BacG2zxLxoWE tnIt1U7R44Y3Ecb9rMZ17bCkJcp0n9QsMDXerAoQ= To: "tls@ietf.org" From: Stephen Farrell Openpgp: id=5BB5A6EA5765D2C5863CAE275AB2FAF17B172BEA; url= Autocrypt: addr=stephen.farrell@cs.tcd.ie; prefer-encrypt=mutual; keydata= mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nemCP5PMvmh 5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kTq0IqYzsEv5HI58S+ QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtEgvw4fVhVWJuyy3w//0F2tzKr EMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy+pAh4EKzS1FE7BOZp9daMu9MUQmDqtZU bUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqO Vz+7L+WiVfxLbeVqBwV+4uL9to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJg b097ZaNyuY1ETghVB5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k 4LyM2lp5FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9tlyWxn5Xi HzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQABtDJTdGVwaGVuIEZh cnJlbGwgKDIwMTcpIDxzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPokCQAQTAQgAKgIbAwUJ CZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAUCWj6jdwIZAQAKCRBasvrxexcr6o7QD/9m x9DPJetmW794RXmNTrbTJ44zc/tJbcLdRBh0KBn9OW/EaAqjDmgNJeCMyJTKr1ywaps8HGUN hLEVkc14NUpgi4/Zkrbi3DmTp25OHj6wXBS5qVMyVynTMEIjOfeFFyxG+48od+Xn7qg6LT7G rHeNf+z/r0v9+8eZ1Ip63kshQDGhhpmRMKu4Ws9ZvTW2ACXkkTFaSGYJj3yIP4R6IgwBYGMz DXFX6nS4LA1s3pcPNxOgrvCyb60AiJZTLcOk/rRrpZtXB1XQc23ZZmrlTkl2HaThL6w3YKdi Ti1NbuMeOxZqtXcUshII45sANm4HuWNTiRh93Bn5bN6ddjgsaXEZBKUBuUaPBl7gQiQJcAlS 3MmGgVS4ZoX8+VaPGpXdQVFyBMRFlOKOC5XJESt7wY0RE2C8PFm+5eywSO/P1fkl9whkMgml 3OEuIQiP2ehRt/HVLMHkoM9CPQ7t6UwdrXrvX+vBZykav8x9U9M6KTgfsXytxUl6Vx5lPMLi 2/Jrsz6Mzh/IVZa3xjhq1OLFSI/tT2ji4FkJDQbO+yYUDhcuqfakDmtWLMxecZsY6O58A/95 8Qni6Xeq+Nh7zJ7wNcQOMoDGj+24di2TX1cKLzdDMWFaWzlNP5dB5VMwS9Wqj1Z6TzKjGjru q8soqohwb2CK9B3wzFg0Bs1iBI+2RuFnxLkCDQRaPVAyARAA+g3R0HzGr/Dl34Y07XqGqzq5 SU0nXIu9u8Ynsxj7gR5qb3HgUWYEWrHW2jHOByXnvkffucf5yzwrsvw8Q8iI8CFHiTYHPpey 4yPVn6R0w/FOMcY70eTIu/k6EEFDlDbs09DtKcrsT9bmN0XoRxITlXwWTufYqUnmS+YkAuk+ TLCtUin7OdaS2uU6Ata3PLQSeM2ZsUQMmYmHPwB9rmf+q2I005AJ9Q1SPQ2KNg/8xOGxo13S VuaSqYRQdpV93RuCOzg4vuXtR+gP0KQrus/P2ZCEPvU9cXF/2MIhXgOz207lv3iE2zGyNXld /n8spvWk+0bH5Zqd9Wcba/rGcBhmX9NKKDARZqjkv/zVEP1X97w1HsNYeUFNcg2lk9zQKb4v l1jx/Uz8ukzH2QNhU4R39dbF/4AwWuSVkGW6bTxHJqGs6YimbfdQqxTzmqFwz3JP0OtXX5q/ 6D4pHwcmJwEiDNzsBLl6skPSQ0Xyq3pua/qAP8MVm+YxCxJQITqZ8qjDLzoe7s9X6FLLC/DA L9kxl5saVSfDbuI3usH/emdtn0NA9/M7nfgih92zD92sl1yQXHT6BDa8xW1j+RU4P+E0wyd7 zgB2UeYgrp2IIcfG+xX2uFG5MJQ/nYfBoiALb0+dQHNHDtFnNGY3Oe8z1M9c5aDG3/s29QbJ +w7hEKKo9YMAEQEAAYkCJQQYAQgADwUCWj1QMgIbDAUJCZQmAAAKCRBasvrxexcr6qwvD/9b Rek3kfN8Q+jGrKl8qwY8HC5s4mhdDJZI/JP2FImf5J2+d5/e8UJ4fcsT79E0/FqX3Z9wZr6h sofPqLh1/YzDsYkZDHTYSGrlWGP/I5kXwUmFnBZHzM3WGrL3S7ZmCYMdudhykxXXjq7M6Do1 oxM8JofrXGtwBTLv5wfvvygJouVCVe87Ge7mCeY5vey1eUi4zSSF1zPpR6gg64w2g4TXM5qt SwkZVOv1g475LsGlYWRuJV8TA67yp1zJI7HkNqCo8KyHX0DPOh9c+Sd9ZX4aqKfqH9HIpnCL AYEgj7vofeix7gM3kQQmwynqq32bQGQBrKJEYp2vfeO30VsVx4dzuuiC5lyjUccVmw5D72J0 FlGrfEm0kw6D1qwyBg0SAMqamKN6XDdjhNAtXIaoA2UMZK/vZGGUKbqTgDdk0fnzOyb2zvXK CiPFKqIPAqKaDHg0JHdGI3KpQdRNLLzgx083EqEc6IAwWA6jSz+6lZDV6XDgF0lYqAYIkg3+ 6OUXUv6plMlwSHquiOc/MQXHfgUP5//Ra5JuiuyCj954FD+MBKIj8eWROfnzyEnBplVHGSDI ZLzL3pvV14dcsoajdeIH45i8DxnVm64BvEFHtLNlnliMrLOrk4shfmWyUqNlzilXN2BTFVFH 4MrnagFdcFnWYp1JPh96ZKjiqBwMv/H0kw== Message-ID: <7374648a-d684-87be-0807-219bc10793ac@cs.tcd.ie> Date: Wed, 26 Jun 2019 11:20:50 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.7.1 MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="Od3b3HfeYWO5ArtcdqvVhctDBe1spTBkF" Archived-At: Subject: [TLS] publishing ESNIKeys under a .well-known URI... X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 26 Jun 2019 10:20:59 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --Od3b3HfeYWO5ArtcdqvVhctDBe1spTBkF Content-Type: multipart/mixed; boundary="di7D82PPNaYMujqLRaI6uRnbCHe4ojmo8"; protected-headers="v1" From: Stephen Farrell To: "tls@ietf.org" Message-ID: <7374648a-d684-87be-0807-219bc10793ac@cs.tcd.ie> Subject: publishing ESNIKeys under a .well-known URI... --di7D82PPNaYMujqLRaI6uRnbCHe4ojmo8 Content-Type: multipart/mixed; boundary="------------17FC7FAAF9376DF009FE2842" Content-Language: en-GB This is a multi-part message in MIME format. --------------17FC7FAAF9376DF009FE2842 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hiya, I'm wondering if a thing I did when setting up a web server with ESNI might be generally useful for some, but not all, implementers. My web server doesn't have an API it can use to update ESNIKeys in the DNS. Many implementations/deployments may have such an API but in my case, the zone file that includes the ESNIKeys RR is on another machine and the web server doesn't have write access to that. I do control both machines as it happens, but I still don't want to give general write-access to the web server. So what I did was create a .well-known URI on the web server that allows our "zone factory" to poll for changes to ESNIKeys RRs. In my case I have the web server generate new ESNIKeys each hour and publish those at =2Ewell-known URIs; the "zone factory" polls for those (also hourly) and when it sees new values, it checks that those work, and if they do it updates the zone file and re-publishes (DNSSEC signing, sending to hidden master etc.) There are some more details below that could easily change if we wanted to standardare this. Anyway it all seems to work ok and could be useful for others in a similar situation, or for web server implementers as a generic way to make ESNIKeys available, so I'm wondering if this'd be a useful PR for the ESNI I-D, or if a separate I-D would be useful, or maybe not enough people would need to do this to bother? Cheers, S. Details: - Web server generates new ESNIKeys hourly at N past the hour via a cronjob - ESNIKeys are "current" for an hour, and published with a TTL of 1800 for no particularly good reason - Old ESNIKeys are still usable for 3 hours, again for no particular reason (just 2 should do:-) - Web server has a set of "hidden" sites ($HIDDEN) and a "cover" site ($COVER) - The cronjob creates creates a JSON file for each hidden site at https://$COVER/.well-known/esni/$HIDDEN.json - Each JSON file contains an array with the ESNIKeys RR values for that particular $HIDDEN as shown below: [ { "ESNIKeys.version": 0xff01, "desired-ttl": 1800, "ESNIKeys": "/wH5QHc...=3D" }, { "ESNIKeys.version": 0xff02, "desired-ttl": 1800, "ESNIKeys": "FF02897...OA" } ] - The specifics of the JSON structure are just what was handy for me, I'm sure it could be better, and would change as we go if we standardise this - The values above with ellipses are the RR values we want to eventually see in the DNS - On the zone factory, a cronjob runs at N+3 past the hour, it knows all the names involved and checks to see if the content at those well-known URIs has changed or not - If the content has changed the cron job attempts to use the ESNIKeys and for each $HIDDEN where that works, it updates the zone file and re-publishes - Possibly interesting unintended consequence: after a TLS client had first gotten ESNIKeys from the DNS for $HIDDEN with the draft-03 ESNIKeys structure containing the public_name field, the TLS client would know both $COVER and $HIDDEN and so could later probe for this .well-known as an alternative to doing so via DoT/DoH. Probably not something a web browser might do, but could be fun for other applications maybe --------------17FC7FAAF9376DF009FE2842 Content-Type: application/pgp-keys; name="0x5AB2FAF17B172BEA.asc" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="0x5AB2FAF17B172BEA.asc" -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nem CP5PMvmh5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kT q0IqYzsEv5HI58S+QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtE gvw4fVhVWJuyy3w//0F2tzKrEMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy +pAh4EKzS1FE7BOZp9daMu9MUQmDqtZUbUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5 iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqOVz+7L+WiVfxLbeVqBwV+4uL9 to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJgb097ZaNyuY1ETghV B5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k4LyM2lp5 FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9t lyWxn5XiHzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQAB tCFTdGVwaGVuIEZhcnJlbGwgPHN0ZXBoZW5AamVsbC5pZT6JAj0EEwEIACcFAlo9 UYwCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQWrL68XsXK+qG CxAApYHWYgGOIL3G6/OpkejdAkQoCVQAK8LJUSf6vzwost4iVfxIKcKW/3RqKNKk rRl8beJ7j1CWXAz9+VXAOsE9+zNxXIDgGA7HlvJnhffl+qwibVgiHgUcJFhCSbBr sjC+1uULaTU8zYEyET//GOGPLF+X+degkE/sesh4zcEAjF7fGPnlncdCCH3tvPZZ sdTcjwOCRVonKsDgQzBTCMz/RPBfEFX44HZx4g1UQAcCA4xlucY8QkJEyCrSNGpG nvGK8DcGSmnstl1/a9fnlhpdFxieX3oY2phJ1WKkYTn6Advrek3UP71CKxpgtPmk d3iUUz/VZa0Cv6YxQXskspRDVEvdCMYSQBtJPQ4y2+5UxVR9GIQXenwYp9AP2niv Voh+ITsDWWeWnnvYMq07rSDjq0nGdj41MJkNX+Yb2PXVyXItcj5ybE3T2+y3pSBG FEZYJGuaL4NwtBJFMOdOtBmUOPbetS2971EL3Izxb7ibOZWDwexv+8R6SWYfP1wV N3p46RyBQuXqJV8ccE11m6vtZTGSYgnLUUFZMRQYH+0hwuYe0T3AA18xDdSYsa8v ovCCd3l5S4UNzIM2PMChqGrEzKapUpZg7+8ACcxRU3b9Ihd7WYjJ+pQPCoWYKozv tEvenbNpE/govO/ED3B14e+R2yevRPjRrsN7PJzSf15fQLuJARwEEAEIAAYFAlo9 UqAACgkQLzyHNoBfjaLrSwf+MIHbFRQ4O5cmLYR5sIByWelN3SuRN/gW8rpKo9Ok Cz6An8uV/iCXy5tNMLzzi0BFl8f22DwBcC5qy9qnlIAdogWam1qWoTAoAD8veEqm uKhYrqJsCcAyNrKYmK0hP3rpHxx1LySDmKYXmw/8qtBXKHTouMm+5tSsznhykRMT AAr2p7PSaHgo+hIVaW/rKSspHjDhhZS+G9mtOZad1IH29M6G1Q1NCO0Ywe8krKLQ IAQlFxtgvOqpPOZNzeKBa/+KbE8TGgMWrkOhC8OeEM5PVzdDhlhD9kPzB/pCKDF5 DofJ/ZRqnDpbKPQ0bsW38AOig3kOc0A27awiBEw3urqR1YkCMwQQAQgAHRYhBH4X CgRchM9GDit5oBDvedn9g1MSBQJbtyScAAoJEBDvedn9g1MSI/oP/0A9J9nrnBMq Zpm857lfYWw+rshLK+tyeP4OQeOqnDFvs9jePpcyJLG3DF2r6VbVKPQq+AE6Uf5h cJBDEN6BjEhRPSbLcqG3A1cz/nNwm8rPmNp+oKhmaBBQGxwciMLmzgynsDydnjPp MyEs04zvsbsl4vrp2095o105l8KcrrxQrioFjbwveGwHQK9bxJKhx9D+gIk+MouB ur45UDKTZkMZrr9FGrtkyXCGAxvKdcNC5Oa8z9sj1rcUJfG/OpVAMWhArdlZbFUQ yoX6pU2Zb1CR2qpWAVerGSfBhmfCyStjARqaKxlftjO+Bj3Jj73Cr5eqej3qB5+V 4BCsPjr4RLvVbYUCPsRdxWc+nBLlfVYkRURu21g1hFm5KFPjgUkyo1s4vjUOY8Dy I+xLGF7f/IhUBG6l+Vswhpwu7ydalZkeFiPx5xna5NfbEYxvsIf71DvipGvIOaHv X4egWoFgm8n/9c3rcMxJtpwHPSsUt5dgLsyu6VE0IbvOAc3dN7CWJ355DVFJq9Zg 2YVf0izSpyyzJeGsgkfjW6xpmdvZxuT2UcN4BTcm6vYqueASGrb3lfhzC5gpeVsc /MoSjTS65vNWbpzONZWMZuLEFraxWJzC0JrDK3NCd0VN3kstqGkVbUIiYOnUm8Vu 4zoVMLlGWzHLIGoPRG2nRezn1YyNfyb5iQGcBBABCgAGBQJbxcflAAoJEGo7ETk8 pK1gE7QL/ApC5P68W5DrI1787WJVZv1u4t/g39vTr7Xer3UMTVQg10vpa7pmqOGh jIDzDMg3Pe3K3M7fVzfAlUA1qw6ne4RCueVoRKpubeF4AlYbMr0K6hNCPjt5uAxm bBVuejKTc6pru5rv5gKL0nDbr+Snft5xt7juBLSSimw0/41sZnkjCxo9rF/RA/v6 +uWyK171RKmsEYu8fFtw1eqUNt/Xj792TUixE3pxXheNtQtZGk/9P3W83ChhG4Fh 5EQsn0pIh9wZIAbMRLpgRKyW87fWHZC8/YH8h7afarvn9Thl5pFUldCe22mNJj6K LChn2aEHQd+PdY1GBpZEcmNEUPuovwzatM0h64hCzTm41eDqRfihZVBT7TbfXQnv 8rywa42Mk756RGzzEZcQEhwQXZcMQUfxIQQ2VyJo0zG36VdZTQF7TF/4Lz7/3cJ5 6jOIm+dwPXtu+C2wAQuD4USOLt4JWPYpqzDfHYJIND/497P9Z9SuQeahr2ez3DRB g3qsHEjBV7QyU3RlcGhlbiBGYXJyZWxsICgyMDE3KSA8c3RlcGhlbi5mYXJyZWxs QGNzLnRjZC5pZT6JAkAEEwEIACoCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwEC HgECF4AFAlo+o3cCGQEACgkQWrL68XsXK+qO0A//ZsfQzyXrZlu/eEV5jU620yeO M3P7SW3C3UQYdCgZ/TlvxGgKow5oDSXgjMiUyq9csGqbPBxlDYSxFZHNeDVKYIuP 2ZK24tw5k6duTh4+sFwUualTMlcp0zBCIzn3hRcsRvuPKHfl5+6oOi0+xqx3jX/s /69L/fvHmdSKet5LIUAxoYaZkTCruFrPWb01tgAl5JExWkhmCY98iD+EeiIMAWBj Mw1xV+p0uCwNbN6XDzcToK7wsm+tAIiWUy3DpP60a6WbVwdV0HNt2WZq5U5Jdh2k 4S+sN2CnYk4tTW7jHjsWarV3FLISCOObADZuB7ljU4kYfdwZ+WzenXY4LGlxGQSl AblGjwZe4EIkCXAJUtzJhoFUuGaF/PlWjxqV3UFRcgTERZTijguVyREre8GNERNg vDxZvuXssEjvz9X5JfcIZDIJpdzhLiEIj9noUbfx1SzB5KDPQj0O7elMHa1671/r wWcpGr/MfVPTOik4H7F8rcVJelceZTzC4tvya7M+jM4fyFWWt8Y4atTixUiP7U9o 4uBZCQ0GzvsmFA4XLqn2pA5rVizMXnGbGOjufAP/efEJ4ul3qvjYe8ye8DXEDjKA xo/tuHYtk19XCi83QzFhWls5TT+XQeVTMEvVqo9Wek8yoxo67qvLKKqIcG9givQd 8MxYNAbNYgSPtkbhZ8SJARwEEAEIAAYFAlo9UqAACgkQLzyHNoBfjaLzHAgAlWT6 NXEGtw/r1miKNGcopzvzILQ9oB8rKI9U9EL6tOf/y2V5oYee/GyQDb3ZdoPxxYYc Jf+RyiH1nMoqUIZiZJaf3bJXinDZ5+AdfE++UR2NBvqaNyC6u3r24jo1B/sagKbY tWgsYtRqHLD4IWi37MZrVyjBuF7u14Q07+uhjq6mX2O/tHpCYw/Q82tbeTRPyUf1 WQOAfD1kfBpW9PvAva5Iw9FWeXpCXRzwxnCZhYfGfqtuSw6CPBYLdbikqML6FZ7E DuTBb/8um1wK7Y9bgeIQC+CYjhYB5RXa1tDJRab2Js4luCvSR0w/CgHw26293tlv e2Q6UTrmHxP5U22DlokCPQQTAQgAJwUCWj1QMgIbAwUJCZQmAAULCQgHAgYVCAkK CwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6tJpD/4rrILH+meP07vrx8wW5eYuqCiP GYnh/CXxIF8eLrfbe5d4QRgtq+w6UeQPMyzKRIRiCoBXB2oJLBZHyxBPxZlg33dT MrEGn8QWKx2iNuz9rZMXyOSWFetuO01d/aUPd5BnbLbIyK5of8xCQlXM6KH8bc+9 gQ7edR9mfLTdvBf2FR522hg8BRBM1imKc3vO8v39+qIHHRjuiwxBBCAOhHtHRsZX ripS0uFA07dM46Oi/E8osjx6fQt/lH5z/PN+2adxYSrLSAXfr1oD3RxYNhuWgyGF L64/VCQb1YGjf0Z5MBPnWm9jgUoOY5K9eNSS0L83WeJjlF5+Q/WOgB+rb49Prm2D Feo9+S9f2V53Llz1WIspXJg6f+n9lmHE94MfQj1GAHCzI0FeL19lvM+LhD8jJSCb hrC3+yobyy/AUOs5Z3E+njjX1FF/VCVAs6iOa6i+XG+Y1hh3ir2y1kckJ5auT10M SU8GEZu9ayU4M3o3N9yxOjaoP0NuQ4MMLL/n/u4u94AeZaHPNBXn/hVfVRRmpRXt GKvJtFAEppGEYezB+bLKIm6XlpPkhnwYzleLZ7AMEco2C6QM8QPB3g3JpS3sqRhA 5rEP4lL16BmijmF+CHoPE/zwgKZbKpyVDqvIW5IDgvfIC2X4pbZDRvGIUKaGSB4+ ksZgUUnNyvfQr2p7jokCMwQQAQgAHRYhBH4XCgRchM9GDit5oBDvedn9g1MSBQJb tySbAAoJEBDvedn9g1MSeKkQAJm44jt1kwHgQgeDBKdjdvl0AjE0xVEQxriZ6lP/ l//34YT0auFfzsYIrChSpQXAEtobBAr4Ohw1Us+BZe+H5P8vm6LRuPwozC3SjwfX 4Iec8+9ot6tIVg4sbedDSgb/CCFVjsmIGcQ1P73JLJTBJ6mxYCV/gn3QC6bwDOFo 7kD9FDHCjRN8XfhHQ4Q9cYyt06uF31qG/aumgWYC9geCGgAwiHgwxNYb9GoJ0iZj CROwbYvLTcQgsVUW2bTmsVR13UVKDsdl02sRV7qcVYW6R0a3Ra8KudX+nt25H5DR Gd382KZ5W8pydsy/viTvD9z6v0ulChBYxAedIvGIClrhbxlLEPmIg4ImVOLGqsUg Vm32J95WOjEkk4PEZ12xSDBtwhSJqmJNboWlfmw43KdIbY8zNhffIO3N6O7FsdGx mqyHeLoTpqY+ySVUPpbuyW8ujnI/J//+6hdTZ9dQsEJQlWngKuWOQ5ma58MPSN88 zllsqhZAFQjNxqnkSzL6ZQ+v/jvuRRe16B80AeO55DsmbWsMv/YLLD1mSi7+Khy2 EtMBhgojWwrGMvdLN6X3mnzNJEscYyLxM9tSk+iySP2sLthK0BVgpAzBSdaf/ezI z60P+neHDzteNFf8Mn7lmgYk1amvZoJ29s5+n2HwxyRL5dVMyMdyQmntubbctfqr Z0tIiQGcBBABCgAGBQJbxcflAAoJEGo7ETk8pK1gnCYMAJY4FeIYjlIXGghFWzsB 4fYwK1+iaFpU3fSto5qcrqVtVPjXpwqczqBWeXGyQxiB0kan4OVAXydIeaP8EAuF CA7paP3s9STLJBO3KurkwyRkPW5zo0X7xVqaVToRsX2Ul98KVJoHYQD1KdezEtwl vpNwiiBr42AYR751Vm6JBVAbQXuFpB3c8bUV0OkkRxNFtL8/2PieHar58n5dntGk bPlPkztahsFqktgacIgXHX5vaT+7YeeZ1DWLOYjGO0wNhkOSeroCmxwJUikU7joB p823L7r5KfpqWTPpSCzVstQKZUGmmoE1qCswY/Ud5wvp9SccpIILkRXj0rZRtfnE 5MpL3hjmtNzfDd9qIsJtBJlSB2hZwAsVm1l+EWN9hG3tqyA43niUMy2n6q690of3 berSiQ+kvY/aC9Hx8I+bKzOV9/J2VUTqfaPZa4Uy2rVX5Q2p69n/PMj7mEer0rCL 3j9V16J9c+s0BSkXoKdtYdB0TWVhBgUybd9qtYcwHWvhP7QuU3RlcGhlbiBGYXJy ZWxsIDxzdGVwaGVuQHRvbGVyYW50bmV0d29ya3MuY29tPokCPQQTAQgAJwUCWj1R WgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6jsc EADEcB0WQEZn2AkrzDs1RhL0Lp6cZi0BigofkbcGfdhJyMSs19C0dhvncrAFClVI 6/Udw3yFtDyYtOCf2W3M3A1K6/RfEizCLzTsdFIhni9gOJLlUpXViQtgrlstjk7h qVV3Ooz4BlCqS4cG7rfqf4LQQPpTAuFUEV9I28FBUB2irqC+v4gTysIgpMw0bA1y BU9sX5jE/tRkzqnuzZrkwiobDtRFJ9qp+7O2JtcY4EsVtLAsaodJKc5cF8R4OvB1 n66vxxcgg9Eh4JNWZ47xsaCmAGo1Bcb2jIY35OtgAL7gCGLRSMKTtAaPy1/fEgIq hCljJ9x40Fkn/3r2BX21WC9HFSPFTBz2RluLRzxdgxOrkYK8EiHUPoE5b1AEzZKw 2AbeXfr57f5zYsN3IqfbQLUjMYtUN1wK3Pjb+idD972wyXMWt8uOzlI7b9Ocu+nY m2whBfJv9Pmp3QYTmPz+LB9lH65VNVUSxSXVr5iWXO3qx1HtEiGEqkporMQCTh3T 5Ud3PvMSRBFFKNs9WhJ/Lxz+SV30WLwG6dr5mQqlzAhb4Phc/zekZyXRdS/oDKrB LUucS36O//49JeyRi1QvOfxnfmIqRIAf/k3PoYJmTo5E82//r5Qj3YGlRu78ba0H Arxs+ACD6AnEHHcbswpbtVEKYzlSu0Ar0Dc7vRWM/IyQdIkBHAQQAQgABgUCWj1S oAAKCRAvPIc2gF+NosIsB/9f/29FNla3BJfGIEIDnhrqGD0i9bSa89SqBd++uG06 TQgW5wsqtNcrwn81yZTq6XE6i9VtD4GKfqC0d4KZJr9bnbeD81cI64VOdL8zJWJs 0vj5EIXCobKyX74Kb4uePUyZqwT2Q74I116u/HwA9/FXsPo5isbh4ZqD4t0VHpWk mfq1FPT9a/JPyX46qKqB2Fce/7Qy+SQP1NfkuUlbhUH/JG9aSSYvk3lznNiH41x9 M+FDlL106itXOubrl3oi2fT3fsSedq7uzt+IV0DQEeNaoQAUuwEhdB8IWOMqN2wo DjGVKJftfsSWY9ilZrnDBNDrp0vRqcx33LUMkIw4d7iBiQIzBBABCAAdFiEEfhcK BFyEz0YOK3mgEO952f2DUxIFAlu3JJwACgkQEO952f2DUxJjuw/6ApHSsVTWD4a0 H6FJ23A9Ftpy+aXZ4vYlzkSrfsn2ECrEfK3lXQh/uzwjJUDYZeB1/BQsFZtcYNQO JSSHbQ49BFRLwb1J/wBZG4bbmrkLxnNbKDKQvzxEpclkMW0Dj0J6o7kGrmzIGGrh B+JJN99AcineHRug8ZSFIERRCmigxdhAKU0BFD7P+5HNHltSL3DF1c2fFOf2JrgB KVoE+9RhMZjWNbYetFFLCkjXb5Rpay9zeMm1DxfSTGAnuOwUXW6qq4hnl5+VC/48 ceDZElLLfu7RQUZv44pkSTOWZs+iQoJiHMFHk9wPqyB2Vok1yJ2a2j27WhXrJlPw nZbgJO5RyWDG3p/eVmpl5Uuc2dsfIpR17KnAuWpghK6V+cyFncDoGCl/YG2Mvool sW08FiZh3Ej4dnJjj25TZkeFG74JJDXLvMYpJfSBGnmETv4Dhcm2xPqVMuFuL1qJ lMbVLrMo2GXeo03OzNyvbs+u8WLIaGm5hC7N1CXY8wZs4jo6OJ/expvnc07dEuws 4zT3AiWv3nIouWReRStZy9QkavDocqbyPmilcdPCYk4BsOlzpwwO74hNG7iyl0Kd AlwTxGQ7y0rJou6HYa1TmRhIEr3vKvlW+JfUUrqtjXgsuacTXo4+Ira2JUErL2cY zQMq1j4r1ZyhFnuz93s7Rsx/Nw0+0YuJAZwEEAEKAAYFAlvFx+UACgkQajsROTyk rWCJqwv+NLVPE4sD4sDA2/6Ek7UsRIUkg+S39fhqWsLc4rtw/mDunv8Un61I3K04 fZ2Ry4nF9hZM0a710UvXFbStvrzRJO3EAAcdJR9LTCd19e8UeruQbIee3YT91U4N kC9JMpecfq62/teOAU2e5P3fWYaLs5ZX7zCLwWuBcW2l3SyoljQczM85HhJ3XHm+ FnwQ6D9xRle+lvWTcuC9d1yAyUb8IOospcL2lJTmy8e3r79R24hPlSB4LDe0wEN8 AXbagrcAQZjwyaHyWxjJbTwZ0b43WGdfIqZ1ElOeoffbketPGRmWvx5xUvb2ALFB BdETzV270gs5XDJgJ1SIIKOyDADxwvroTe2jD8C/841eEql5QSow3s/U3zRqk3mt tto8Qw/DN71aeh6dmYSsvd2UjsHw/vofOPRBGxZLEkKTEvMnhmMW9hiKPkPia+Qg evYE020qpKSxLEdWA8nprHwxmGiDNesCfXSC6vm1qfyj5g8HzxSckq9ZaMhKMCo7 vxflUEDuuQINBFo9UDIBEAD6DdHQfMav8OXfhjTteoarOrlJTSdci727xiezGPuB HmpvceBRZgRasdbaMc4HJee+R9+5x/nLPCuy/DxDyIjwIUeJNgc+l7LjI9WfpHTD 8U4xxjvR5Mi7+ToQQUOUNuzT0O0pyuxP1uY3RehHEhOVfBZO59ipSeZL5iQC6T5M sK1SKfs51pLa5ToC1rc8tBJ4zZmxRAyZiYc/AH2uZ/6rYjTTkAn1DVI9DYo2D/zE 4bGjXdJW5pKphFB2lX3dG4I7ODi+5e1H6A/QpCu6z8/ZkIQ+9T1xcX/YwiFeA7Pb TuW/eITbMbI1eV3+fyym9aT7Rsflmp31Zxtr+sZwGGZf00ooMBFmqOS//NUQ/Vf3 vDUew1h5QU1yDaWT3NApvi+XWPH9TPy6TMfZA2FThHf11sX/gDBa5JWQZbptPEcm oazpiKZt91CrFPOaoXDPck/Q61dfmr/oPikfByYnASIM3OwEuXqyQ9JDRfKrem5r +oA/wxWb5jELElAhOpnyqMMvOh7uz1foUssL8MAv2TGXmxpVJ8Nu4je6wf96Z22f Q0D38zud+CKH3bMP3ayXXJBcdPoENrzFbWP5FTg/4TTDJ3vOAHZR5iCunYghx8b7 Ffa4UbkwlD+dh8GiIAtvT51Ac0cO0Wc0Zjc57zPUz1zloMbf+zb1Bsn7DuEQoqj1 gwARAQABiQIlBBgBCAAPBQJaPVAyAhsMBQkJlCYAAAoJEFqy+vF7FyvqrC8P/1tF 6TeR83xD6MasqXyrBjwcLmziaF0Mlkj8k/YUiZ/knb53n97xQnh9yxPv0TT8Wpfd n3BmvqGyh8+ouHX9jMOxiRkMdNhIauVYY/8jmRfBSYWcFkfMzdYasvdLtmYJgx25 2HKTFdeOrszoOjWjEzwmh+tca3AFMu/nB++/KAmi5UJV7zsZ7uYJ5jm97LV5SLjN JIXXM+lHqCDrjDaDhNczmq1LCRlU6/WDjvkuwaVhZG4lXxMDrvKnXMkjseQ2oKjw rIdfQM86H1z5J31lfhqop+of0cimcIsBgSCPu+h96LHuAzeRBCbDKeqrfZtAZAGs okRina9947fRWxXHh3O66ILmXKNRxxWbDkPvYnQWUat8SbSTDoPWrDIGDRIAypqY o3pcN2OE0C1chqgDZQxkr+9kYZQpupOAN2TR+fM7JvbO9coKI8Uqog8CopoMeDQk d0YjcqlB1E0svODHTzcSoRzogDBYDqNLP7qVkNXpcOAXSVioBgiSDf7o5RdS/qmU yXBIeq6I5z8xBcd+BQ/n/9Frkm6K7IKP3ngUP4wEoiPx5ZE5+fPIScGmVUcZIMhk vMvem9XXh1yyhqN14gfjmLwPGdWbrgG8QUe0s2WeWIyss6uTiyF+ZbJSo2XOKVc3 YFMVUUfgyudqAV1wWdZinUk+H3pkqOKoHAy/8fST =3DYzQY -----END PGP PUBLIC KEY BLOCK----- --------------17FC7FAAF9376DF009FE2842-- --di7D82PPNaYMujqLRaI6uRnbCHe4ojmo8-- --Od3b3HfeYWO5ArtcdqvVhctDBe1spTBkF Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEW7Wm6ldl0sWGPK4nWrL68XsXK+oFAl0TRwIACgkQWrL68XsX K+qJ1A/+McduxYCvLoDsvLnPTn0p9BZGhTjXNxItPMbKqaS2lHqm2uPUQ/d0GbEd M3zkPniBcWCQGpGG7Hx3tEeaEzmNeezUOHaGTsk40IoG4ANpq5K8Q8XAQVojSqPt +FhplnM+ZLgXq0Y2Ll3CiL03cai5jPAufqlRG+Wt4Vg19/KcgTtN/6wkqnhALhKd DNE/j7KcmJSWss8BODo46eDWnwN2rZKiEbIbmWhxiSjiUaCzD5rM6FOcAsxGcxYh qwxxCNVZqMAKGRQciicFvn8pc/5j/A5EFp3ZjA4KnMB300B5QMKpcnS1JA20iAKQ 0dUvNtukv67VPSUJKNu5sQQ5/Qto4NQIZx3bdfHsPjMDFmqSXYFA1Zj2djzsbGWt 4xEIUDI1uldGtROKs7UkXLlHssQnocJdRAsrVkzCco+0pi6zOqV8DXIE5ctY1KyR gb6eDe+37UQmcTxRdy+FMoo8wqcCzPtBYl3tiPP4PhklFD3ZxbkQx2p5/rI0tyRF qsZsEY6Ge9DFXkbomKuzwoRBHisoJ4WAU4oV2rCnsrK6u376FtX2G7asdW7P0am0 fbzok5BbIw0Ft4zBnH/5XJYlWBL+5XT9S2MGKJfOCT9Hi1xW5+Wlh09TFbNzA2AM HL8F7TuL7PH/tqdFdWpMDg9cK371Q0xGPhQ6E5wqBOxq19rCwvs= =BHgJ -----END PGP SIGNATURE----- --Od3b3HfeYWO5ArtcdqvVhctDBe1spTBkF-- From nobody Wed Jun 26 08:58:13 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 80798120059 for ; Wed, 26 Jun 2019 08:58:12 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.199 X-Spam-Level: X-Spam-Status: No, score=-4.199 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id d-biZaIz12YI for ; Wed, 26 Jun 2019 08:58:10 -0700 (PDT) Received: from tuna.sandelman.ca (tuna.sandelman.ca [209.87.249.19]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BAE9012004F for ; Wed, 26 Jun 2019 08:58:10 -0700 (PDT) Received: from sandelman.ca (obiwan.sandelman.ca [209.87.249.21]) by tuna.sandelman.ca (Postfix) with ESMTP id 496FC3808A; Wed, 26 Jun 2019 11:56:26 -0400 (EDT) Received: by sandelman.ca (Postfix, from userid 179) id CAE1DE68; Wed, 26 Jun 2019 11:58:09 -0400 (EDT) Received: from sandelman.ca (localhost [127.0.0.1]) by sandelman.ca (Postfix) with ESMTP id C9512E37; Wed, 26 Jun 2019 11:58:09 -0400 (EDT) From: Michael Richardson To: Stephen Farrell cc: "tls\@ietf.org" In-Reply-To: <7374648a-d684-87be-0807-219bc10793ac@cs.tcd.ie> References: <7374648a-d684-87be-0807-219bc10793ac@cs.tcd.ie> X-Mailer: MH-E 8.6; nmh 1.7+dev; GNU Emacs 24.5.1 X-Face: $\n1pF)h^`}$H>Hk{L"x@)JS7<%Az}5RyS@k9X%29-lHB$Ti.V>2bi.~ehC0; <'$9xN5Ub# z!G,p`nR&p7Fz@^UXIn156S8.~^@MJ*mMsD7=QFeq%AL4m Archived-At: Subject: Re: [TLS] publishing ESNIKeys under a .well-known URI... X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 26 Jun 2019 15:58:13 -0000 --=-=-= Content-Type: text/plain Stephen Farrell wrote: > My web server doesn't have an API it can use to update > ESNIKeys in the DNS. Many implementations/deployments may > have such an API but in my case, the zone file that > includes the ESNIKeys RR is on another machine and the > web server doesn't have write access to that. I do > control both machines as it happens, but I still don't > want to give general write-access to the web server. When you say, "general write-access", did you mean that you didn't want to setup Dynamic DNS to be able to update the QNAMEs involved, because that usually permits the web server to delete A and AAAA records, as well as updating the ESNI ? Or did you mean "general write-access", meaning NFS or something like that? -- Michael Richardson , Sandelman Software Works -= IPv6 IoT consulting =- --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCAAdFiEEbsyLEzg/qUTA43uogItw+93Q3WUFAl0TlhEACgkQgItw+93Q 3WWJPgf/bDrp/NsqhqZ/GpaOpLD58AtMmQeqE7xzs0hGK+TwK4QneH+OKVK2Ltte jjpuZjirPaN9eIs1WGvxGo9pm3NlHeI3y29cKXaqxz/LbcZS6K5z6mH7h8/7mrM5 +1Jz34Tr7f8Ze6kcVUrfK+EA05cN40BNQxS4JIefOSsF4oNsuGwsVqgKW5/sQnl7 n+CT6OLd0pUSSeoVVhK+H7qNfoiqOAIffJQRrgztRzogioEhGTQwriCU+DFOFTAG cisSKW5uWd2ptvg/QN6gZLf/WhdfRBxx2J9ON/kLWHPC7wpefNTc2I+V7zajWlZd XDi3FmksE4QJnUry5p5f+K9j5QZ11Q== =qzqx -----END PGP SIGNATURE----- --=-=-=-- From nobody Wed Jun 26 09:11:59 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7D31D1203B7 for ; Wed, 26 Jun 2019 09:11:57 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.299 X-Spam-Level: X-Spam-Status: No, score=-4.299 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id HRQKkVOODzf5 for ; Wed, 26 Jun 2019 09:11:55 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 35E151203B9 for ; Wed, 26 Jun 2019 09:11:55 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id 5DE0EBE3E; Wed, 26 Jun 2019 17:11:53 +0100 (IST) Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WUXy4JJhf8gM; Wed, 26 Jun 2019 17:11:53 +0100 (IST) Received: from [134.226.36.93] (unknown [134.226.36.93]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id 11940BE2C; Wed, 26 Jun 2019 17:11:53 +0100 (IST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1561565513; bh=pKV64h4Tg1r7lAUF94ecAkmGThNxJrWbd9AgcA09s9c=; h=Subject:To:Cc:References:From:Date:In-Reply-To:From; b=cSoWLh0zNGJGaGG86/Bev9xC1e+gwmCSXIUJlYNeYfuCTb6ep/Ddh3I4ajIS2zhT0 tPOHliuRZ5ZUCSI6nqctd11L3AFgT/InPB08EUAr0SgIPZBGugU/SFyNbLMw7IK4xv 0Bn4OqmwvPsBISCaD/ZBE545FDSizwif/NocLhV8= To: Michael Richardson Cc: "tls@ietf.org" References: <7374648a-d684-87be-0807-219bc10793ac@cs.tcd.ie> <18514.1561564689@localhost> From: Stephen Farrell Openpgp: id=5BB5A6EA5765D2C5863CAE275AB2FAF17B172BEA; url= Autocrypt: addr=stephen.farrell@cs.tcd.ie; prefer-encrypt=mutual; keydata= mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nemCP5PMvmh 5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kTq0IqYzsEv5HI58S+ QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtEgvw4fVhVWJuyy3w//0F2tzKr EMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy+pAh4EKzS1FE7BOZp9daMu9MUQmDqtZU bUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqO Vz+7L+WiVfxLbeVqBwV+4uL9to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJg b097ZaNyuY1ETghVB5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k 4LyM2lp5FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9tlyWxn5Xi HzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQABtDJTdGVwaGVuIEZh cnJlbGwgKDIwMTcpIDxzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPokCQAQTAQgAKgIbAwUJ CZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAUCWj6jdwIZAQAKCRBasvrxexcr6o7QD/9m x9DPJetmW794RXmNTrbTJ44zc/tJbcLdRBh0KBn9OW/EaAqjDmgNJeCMyJTKr1ywaps8HGUN hLEVkc14NUpgi4/Zkrbi3DmTp25OHj6wXBS5qVMyVynTMEIjOfeFFyxG+48od+Xn7qg6LT7G rHeNf+z/r0v9+8eZ1Ip63kshQDGhhpmRMKu4Ws9ZvTW2ACXkkTFaSGYJj3yIP4R6IgwBYGMz DXFX6nS4LA1s3pcPNxOgrvCyb60AiJZTLcOk/rRrpZtXB1XQc23ZZmrlTkl2HaThL6w3YKdi Ti1NbuMeOxZqtXcUshII45sANm4HuWNTiRh93Bn5bN6ddjgsaXEZBKUBuUaPBl7gQiQJcAlS 3MmGgVS4ZoX8+VaPGpXdQVFyBMRFlOKOC5XJESt7wY0RE2C8PFm+5eywSO/P1fkl9whkMgml 3OEuIQiP2ehRt/HVLMHkoM9CPQ7t6UwdrXrvX+vBZykav8x9U9M6KTgfsXytxUl6Vx5lPMLi 2/Jrsz6Mzh/IVZa3xjhq1OLFSI/tT2ji4FkJDQbO+yYUDhcuqfakDmtWLMxecZsY6O58A/95 8Qni6Xeq+Nh7zJ7wNcQOMoDGj+24di2TX1cKLzdDMWFaWzlNP5dB5VMwS9Wqj1Z6TzKjGjru q8soqohwb2CK9B3wzFg0Bs1iBI+2RuFnxLkCDQRaPVAyARAA+g3R0HzGr/Dl34Y07XqGqzq5 SU0nXIu9u8Ynsxj7gR5qb3HgUWYEWrHW2jHOByXnvkffucf5yzwrsvw8Q8iI8CFHiTYHPpey 4yPVn6R0w/FOMcY70eTIu/k6EEFDlDbs09DtKcrsT9bmN0XoRxITlXwWTufYqUnmS+YkAuk+ TLCtUin7OdaS2uU6Ata3PLQSeM2ZsUQMmYmHPwB9rmf+q2I005AJ9Q1SPQ2KNg/8xOGxo13S VuaSqYRQdpV93RuCOzg4vuXtR+gP0KQrus/P2ZCEPvU9cXF/2MIhXgOz207lv3iE2zGyNXld /n8spvWk+0bH5Zqd9Wcba/rGcBhmX9NKKDARZqjkv/zVEP1X97w1HsNYeUFNcg2lk9zQKb4v l1jx/Uz8ukzH2QNhU4R39dbF/4AwWuSVkGW6bTxHJqGs6YimbfdQqxTzmqFwz3JP0OtXX5q/ 6D4pHwcmJwEiDNzsBLl6skPSQ0Xyq3pua/qAP8MVm+YxCxJQITqZ8qjDLzoe7s9X6FLLC/DA L9kxl5saVSfDbuI3usH/emdtn0NA9/M7nfgih92zD92sl1yQXHT6BDa8xW1j+RU4P+E0wyd7 zgB2UeYgrp2IIcfG+xX2uFG5MJQ/nYfBoiALb0+dQHNHDtFnNGY3Oe8z1M9c5aDG3/s29QbJ +w7hEKKo9YMAEQEAAYkCJQQYAQgADwUCWj1QMgIbDAUJCZQmAAAKCRBasvrxexcr6qwvD/9b Rek3kfN8Q+jGrKl8qwY8HC5s4mhdDJZI/JP2FImf5J2+d5/e8UJ4fcsT79E0/FqX3Z9wZr6h sofPqLh1/YzDsYkZDHTYSGrlWGP/I5kXwUmFnBZHzM3WGrL3S7ZmCYMdudhykxXXjq7M6Do1 oxM8JofrXGtwBTLv5wfvvygJouVCVe87Ge7mCeY5vey1eUi4zSSF1zPpR6gg64w2g4TXM5qt SwkZVOv1g475LsGlYWRuJV8TA67yp1zJI7HkNqCo8KyHX0DPOh9c+Sd9ZX4aqKfqH9HIpnCL AYEgj7vofeix7gM3kQQmwynqq32bQGQBrKJEYp2vfeO30VsVx4dzuuiC5lyjUccVmw5D72J0 FlGrfEm0kw6D1qwyBg0SAMqamKN6XDdjhNAtXIaoA2UMZK/vZGGUKbqTgDdk0fnzOyb2zvXK CiPFKqIPAqKaDHg0JHdGI3KpQdRNLLzgx083EqEc6IAwWA6jSz+6lZDV6XDgF0lYqAYIkg3+ 6OUXUv6plMlwSHquiOc/MQXHfgUP5//Ra5JuiuyCj954FD+MBKIj8eWROfnzyEnBplVHGSDI ZLzL3pvV14dcsoajdeIH45i8DxnVm64BvEFHtLNlnliMrLOrk4shfmWyUqNlzilXN2BTFVFH 4MrnagFdcFnWYp1JPh96ZKjiqBwMv/H0kw== Message-ID: Date: Wed, 26 Jun 2019 17:11:51 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.7.1 MIME-Version: 1.0 In-Reply-To: <18514.1561564689@localhost> Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="wVNsEw9a3ItGRnlhv94mO8TegkpLGImH0" Archived-At: Subject: Re: [TLS] publishing ESNIKeys under a .well-known URI... X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 26 Jun 2019 16:11:58 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --wVNsEw9a3ItGRnlhv94mO8TegkpLGImH0 Content-Type: multipart/mixed; boundary="2zXS64xYf7KOmmCSQlYzq0IFBH0Tjm4jb"; protected-headers="v1" From: Stephen Farrell To: Michael Richardson Cc: "tls@ietf.org" Message-ID: Subject: Re: [TLS] publishing ESNIKeys under a .well-known URI... References: <7374648a-d684-87be-0807-219bc10793ac@cs.tcd.ie> <18514.1561564689@localhost> In-Reply-To: <18514.1561564689@localhost> --2zXS64xYf7KOmmCSQlYzq0IFBH0Tjm4jb Content-Type: multipart/mixed; boundary="------------0F37BE24531AAD3F2C739CD9" Content-Language: en-GB This is a multi-part message in MIME format. --------------0F37BE24531AAD3F2C739CD9 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hiya, On 26/06/2019 16:58, Michael Richardson wrote: >=20 > Stephen Farrell wrote: > > My web server doesn't have an API it can use to update > > ESNIKeys in the DNS. Many implementations/deployments may > > have such an API but in my case, the zone file that > > includes the ESNIKeys RR is on another machine and the > > web server doesn't have write access to that. I do > > control both machines as it happens, but I still don't > > want to give general write-access to the web server. >=20 > When you say, "general write-access", did you mean that you didn't want= to > setup Dynamic DNS to be able to update the QNAMEs involved, because tha= t > usually permits the web server to delete A and AAAA records, as well as= > updating the ESNI ? >=20 > Or did you mean "general write-access", meaning NFS or something like t= hat? Both really. NFS, or scripting up something with ssh, would be easy but isn't desirable for local reasons. DDNS seemed like more work, (but I didn't check it out in detail tbh), wouldn't be otherwise useful in my setup, and yes would need an authorisation model that doesn't exist at the moment in our setup. Like I said, what I did won't be needed everywhere, but maybe it's useful enough to document properly and/or standardise, not sure. Cheers, S. >=20 > -- > Michael Richardson , Sandelman Software Works > -=3D IPv6 IoT consulting =3D- >=20 >=20 >=20 --------------0F37BE24531AAD3F2C739CD9 Content-Type: application/pgp-keys; name="0x5AB2FAF17B172BEA.asc" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="0x5AB2FAF17B172BEA.asc" -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nem CP5PMvmh5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kT q0IqYzsEv5HI58S+QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtE gvw4fVhVWJuyy3w//0F2tzKrEMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy +pAh4EKzS1FE7BOZp9daMu9MUQmDqtZUbUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5 iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqOVz+7L+WiVfxLbeVqBwV+4uL9 to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJgb097ZaNyuY1ETghV B5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k4LyM2lp5 FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9t lyWxn5XiHzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQAB tCFTdGVwaGVuIEZhcnJlbGwgPHN0ZXBoZW5AamVsbC5pZT6JAj0EEwEIACcFAlo9 UYwCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQWrL68XsXK+qG CxAApYHWYgGOIL3G6/OpkejdAkQoCVQAK8LJUSf6vzwost4iVfxIKcKW/3RqKNKk rRl8beJ7j1CWXAz9+VXAOsE9+zNxXIDgGA7HlvJnhffl+qwibVgiHgUcJFhCSbBr sjC+1uULaTU8zYEyET//GOGPLF+X+degkE/sesh4zcEAjF7fGPnlncdCCH3tvPZZ sdTcjwOCRVonKsDgQzBTCMz/RPBfEFX44HZx4g1UQAcCA4xlucY8QkJEyCrSNGpG nvGK8DcGSmnstl1/a9fnlhpdFxieX3oY2phJ1WKkYTn6Advrek3UP71CKxpgtPmk d3iUUz/VZa0Cv6YxQXskspRDVEvdCMYSQBtJPQ4y2+5UxVR9GIQXenwYp9AP2niv Voh+ITsDWWeWnnvYMq07rSDjq0nGdj41MJkNX+Yb2PXVyXItcj5ybE3T2+y3pSBG FEZYJGuaL4NwtBJFMOdOtBmUOPbetS2971EL3Izxb7ibOZWDwexv+8R6SWYfP1wV N3p46RyBQuXqJV8ccE11m6vtZTGSYgnLUUFZMRQYH+0hwuYe0T3AA18xDdSYsa8v ovCCd3l5S4UNzIM2PMChqGrEzKapUpZg7+8ACcxRU3b9Ihd7WYjJ+pQPCoWYKozv tEvenbNpE/govO/ED3B14e+R2yevRPjRrsN7PJzSf15fQLuJARwEEAEIAAYFAlo9 UqAACgkQLzyHNoBfjaLrSwf+MIHbFRQ4O5cmLYR5sIByWelN3SuRN/gW8rpKo9Ok Cz6An8uV/iCXy5tNMLzzi0BFl8f22DwBcC5qy9qnlIAdogWam1qWoTAoAD8veEqm uKhYrqJsCcAyNrKYmK0hP3rpHxx1LySDmKYXmw/8qtBXKHTouMm+5tSsznhykRMT AAr2p7PSaHgo+hIVaW/rKSspHjDhhZS+G9mtOZad1IH29M6G1Q1NCO0Ywe8krKLQ IAQlFxtgvOqpPOZNzeKBa/+KbE8TGgMWrkOhC8OeEM5PVzdDhlhD9kPzB/pCKDF5 DofJ/ZRqnDpbKPQ0bsW38AOig3kOc0A27awiBEw3urqR1YkCMwQQAQgAHRYhBH4X CgRchM9GDit5oBDvedn9g1MSBQJbtyScAAoJEBDvedn9g1MSI/oP/0A9J9nrnBMq Zpm857lfYWw+rshLK+tyeP4OQeOqnDFvs9jePpcyJLG3DF2r6VbVKPQq+AE6Uf5h cJBDEN6BjEhRPSbLcqG3A1cz/nNwm8rPmNp+oKhmaBBQGxwciMLmzgynsDydnjPp MyEs04zvsbsl4vrp2095o105l8KcrrxQrioFjbwveGwHQK9bxJKhx9D+gIk+MouB ur45UDKTZkMZrr9FGrtkyXCGAxvKdcNC5Oa8z9sj1rcUJfG/OpVAMWhArdlZbFUQ yoX6pU2Zb1CR2qpWAVerGSfBhmfCyStjARqaKxlftjO+Bj3Jj73Cr5eqej3qB5+V 4BCsPjr4RLvVbYUCPsRdxWc+nBLlfVYkRURu21g1hFm5KFPjgUkyo1s4vjUOY8Dy I+xLGF7f/IhUBG6l+Vswhpwu7ydalZkeFiPx5xna5NfbEYxvsIf71DvipGvIOaHv X4egWoFgm8n/9c3rcMxJtpwHPSsUt5dgLsyu6VE0IbvOAc3dN7CWJ355DVFJq9Zg 2YVf0izSpyyzJeGsgkfjW6xpmdvZxuT2UcN4BTcm6vYqueASGrb3lfhzC5gpeVsc /MoSjTS65vNWbpzONZWMZuLEFraxWJzC0JrDK3NCd0VN3kstqGkVbUIiYOnUm8Vu 4zoVMLlGWzHLIGoPRG2nRezn1YyNfyb5iQGcBBABCgAGBQJbxcflAAoJEGo7ETk8 pK1gE7QL/ApC5P68W5DrI1787WJVZv1u4t/g39vTr7Xer3UMTVQg10vpa7pmqOGh jIDzDMg3Pe3K3M7fVzfAlUA1qw6ne4RCueVoRKpubeF4AlYbMr0K6hNCPjt5uAxm bBVuejKTc6pru5rv5gKL0nDbr+Snft5xt7juBLSSimw0/41sZnkjCxo9rF/RA/v6 +uWyK171RKmsEYu8fFtw1eqUNt/Xj792TUixE3pxXheNtQtZGk/9P3W83ChhG4Fh 5EQsn0pIh9wZIAbMRLpgRKyW87fWHZC8/YH8h7afarvn9Thl5pFUldCe22mNJj6K LChn2aEHQd+PdY1GBpZEcmNEUPuovwzatM0h64hCzTm41eDqRfihZVBT7TbfXQnv 8rywa42Mk756RGzzEZcQEhwQXZcMQUfxIQQ2VyJo0zG36VdZTQF7TF/4Lz7/3cJ5 6jOIm+dwPXtu+C2wAQuD4USOLt4JWPYpqzDfHYJIND/497P9Z9SuQeahr2ez3DRB g3qsHEjBV7QyU3RlcGhlbiBGYXJyZWxsICgyMDE3KSA8c3RlcGhlbi5mYXJyZWxs QGNzLnRjZC5pZT6JAkAEEwEIACoCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwEC HgECF4AFAlo+o3cCGQEACgkQWrL68XsXK+qO0A//ZsfQzyXrZlu/eEV5jU620yeO M3P7SW3C3UQYdCgZ/TlvxGgKow5oDSXgjMiUyq9csGqbPBxlDYSxFZHNeDVKYIuP 2ZK24tw5k6duTh4+sFwUualTMlcp0zBCIzn3hRcsRvuPKHfl5+6oOi0+xqx3jX/s /69L/fvHmdSKet5LIUAxoYaZkTCruFrPWb01tgAl5JExWkhmCY98iD+EeiIMAWBj Mw1xV+p0uCwNbN6XDzcToK7wsm+tAIiWUy3DpP60a6WbVwdV0HNt2WZq5U5Jdh2k 4S+sN2CnYk4tTW7jHjsWarV3FLISCOObADZuB7ljU4kYfdwZ+WzenXY4LGlxGQSl AblGjwZe4EIkCXAJUtzJhoFUuGaF/PlWjxqV3UFRcgTERZTijguVyREre8GNERNg vDxZvuXssEjvz9X5JfcIZDIJpdzhLiEIj9noUbfx1SzB5KDPQj0O7elMHa1671/r wWcpGr/MfVPTOik4H7F8rcVJelceZTzC4tvya7M+jM4fyFWWt8Y4atTixUiP7U9o 4uBZCQ0GzvsmFA4XLqn2pA5rVizMXnGbGOjufAP/efEJ4ul3qvjYe8ye8DXEDjKA xo/tuHYtk19XCi83QzFhWls5TT+XQeVTMEvVqo9Wek8yoxo67qvLKKqIcG9givQd 8MxYNAbNYgSPtkbhZ8SJARwEEAEIAAYFAlo9UqAACgkQLzyHNoBfjaLzHAgAlWT6 NXEGtw/r1miKNGcopzvzILQ9oB8rKI9U9EL6tOf/y2V5oYee/GyQDb3ZdoPxxYYc Jf+RyiH1nMoqUIZiZJaf3bJXinDZ5+AdfE++UR2NBvqaNyC6u3r24jo1B/sagKbY tWgsYtRqHLD4IWi37MZrVyjBuF7u14Q07+uhjq6mX2O/tHpCYw/Q82tbeTRPyUf1 WQOAfD1kfBpW9PvAva5Iw9FWeXpCXRzwxnCZhYfGfqtuSw6CPBYLdbikqML6FZ7E DuTBb/8um1wK7Y9bgeIQC+CYjhYB5RXa1tDJRab2Js4luCvSR0w/CgHw26293tlv e2Q6UTrmHxP5U22DlokCPQQTAQgAJwUCWj1QMgIbAwUJCZQmAAULCQgHAgYVCAkK CwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6tJpD/4rrILH+meP07vrx8wW5eYuqCiP GYnh/CXxIF8eLrfbe5d4QRgtq+w6UeQPMyzKRIRiCoBXB2oJLBZHyxBPxZlg33dT MrEGn8QWKx2iNuz9rZMXyOSWFetuO01d/aUPd5BnbLbIyK5of8xCQlXM6KH8bc+9 gQ7edR9mfLTdvBf2FR522hg8BRBM1imKc3vO8v39+qIHHRjuiwxBBCAOhHtHRsZX ripS0uFA07dM46Oi/E8osjx6fQt/lH5z/PN+2adxYSrLSAXfr1oD3RxYNhuWgyGF L64/VCQb1YGjf0Z5MBPnWm9jgUoOY5K9eNSS0L83WeJjlF5+Q/WOgB+rb49Prm2D Feo9+S9f2V53Llz1WIspXJg6f+n9lmHE94MfQj1GAHCzI0FeL19lvM+LhD8jJSCb hrC3+yobyy/AUOs5Z3E+njjX1FF/VCVAs6iOa6i+XG+Y1hh3ir2y1kckJ5auT10M SU8GEZu9ayU4M3o3N9yxOjaoP0NuQ4MMLL/n/u4u94AeZaHPNBXn/hVfVRRmpRXt GKvJtFAEppGEYezB+bLKIm6XlpPkhnwYzleLZ7AMEco2C6QM8QPB3g3JpS3sqRhA 5rEP4lL16BmijmF+CHoPE/zwgKZbKpyVDqvIW5IDgvfIC2X4pbZDRvGIUKaGSB4+ ksZgUUnNyvfQr2p7jokCMwQQAQgAHRYhBH4XCgRchM9GDit5oBDvedn9g1MSBQJb tySbAAoJEBDvedn9g1MSeKkQAJm44jt1kwHgQgeDBKdjdvl0AjE0xVEQxriZ6lP/ l//34YT0auFfzsYIrChSpQXAEtobBAr4Ohw1Us+BZe+H5P8vm6LRuPwozC3SjwfX 4Iec8+9ot6tIVg4sbedDSgb/CCFVjsmIGcQ1P73JLJTBJ6mxYCV/gn3QC6bwDOFo 7kD9FDHCjRN8XfhHQ4Q9cYyt06uF31qG/aumgWYC9geCGgAwiHgwxNYb9GoJ0iZj CROwbYvLTcQgsVUW2bTmsVR13UVKDsdl02sRV7qcVYW6R0a3Ra8KudX+nt25H5DR Gd382KZ5W8pydsy/viTvD9z6v0ulChBYxAedIvGIClrhbxlLEPmIg4ImVOLGqsUg Vm32J95WOjEkk4PEZ12xSDBtwhSJqmJNboWlfmw43KdIbY8zNhffIO3N6O7FsdGx mqyHeLoTpqY+ySVUPpbuyW8ujnI/J//+6hdTZ9dQsEJQlWngKuWOQ5ma58MPSN88 zllsqhZAFQjNxqnkSzL6ZQ+v/jvuRRe16B80AeO55DsmbWsMv/YLLD1mSi7+Khy2 EtMBhgojWwrGMvdLN6X3mnzNJEscYyLxM9tSk+iySP2sLthK0BVgpAzBSdaf/ezI z60P+neHDzteNFf8Mn7lmgYk1amvZoJ29s5+n2HwxyRL5dVMyMdyQmntubbctfqr Z0tIiQGcBBABCgAGBQJbxcflAAoJEGo7ETk8pK1gnCYMAJY4FeIYjlIXGghFWzsB 4fYwK1+iaFpU3fSto5qcrqVtVPjXpwqczqBWeXGyQxiB0kan4OVAXydIeaP8EAuF CA7paP3s9STLJBO3KurkwyRkPW5zo0X7xVqaVToRsX2Ul98KVJoHYQD1KdezEtwl vpNwiiBr42AYR751Vm6JBVAbQXuFpB3c8bUV0OkkRxNFtL8/2PieHar58n5dntGk bPlPkztahsFqktgacIgXHX5vaT+7YeeZ1DWLOYjGO0wNhkOSeroCmxwJUikU7joB p823L7r5KfpqWTPpSCzVstQKZUGmmoE1qCswY/Ud5wvp9SccpIILkRXj0rZRtfnE 5MpL3hjmtNzfDd9qIsJtBJlSB2hZwAsVm1l+EWN9hG3tqyA43niUMy2n6q690of3 berSiQ+kvY/aC9Hx8I+bKzOV9/J2VUTqfaPZa4Uy2rVX5Q2p69n/PMj7mEer0rCL 3j9V16J9c+s0BSkXoKdtYdB0TWVhBgUybd9qtYcwHWvhP7QuU3RlcGhlbiBGYXJy ZWxsIDxzdGVwaGVuQHRvbGVyYW50bmV0d29ya3MuY29tPokCPQQTAQgAJwUCWj1R WgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6jsc EADEcB0WQEZn2AkrzDs1RhL0Lp6cZi0BigofkbcGfdhJyMSs19C0dhvncrAFClVI 6/Udw3yFtDyYtOCf2W3M3A1K6/RfEizCLzTsdFIhni9gOJLlUpXViQtgrlstjk7h qVV3Ooz4BlCqS4cG7rfqf4LQQPpTAuFUEV9I28FBUB2irqC+v4gTysIgpMw0bA1y BU9sX5jE/tRkzqnuzZrkwiobDtRFJ9qp+7O2JtcY4EsVtLAsaodJKc5cF8R4OvB1 n66vxxcgg9Eh4JNWZ47xsaCmAGo1Bcb2jIY35OtgAL7gCGLRSMKTtAaPy1/fEgIq hCljJ9x40Fkn/3r2BX21WC9HFSPFTBz2RluLRzxdgxOrkYK8EiHUPoE5b1AEzZKw 2AbeXfr57f5zYsN3IqfbQLUjMYtUN1wK3Pjb+idD972wyXMWt8uOzlI7b9Ocu+nY m2whBfJv9Pmp3QYTmPz+LB9lH65VNVUSxSXVr5iWXO3qx1HtEiGEqkporMQCTh3T 5Ud3PvMSRBFFKNs9WhJ/Lxz+SV30WLwG6dr5mQqlzAhb4Phc/zekZyXRdS/oDKrB LUucS36O//49JeyRi1QvOfxnfmIqRIAf/k3PoYJmTo5E82//r5Qj3YGlRu78ba0H Arxs+ACD6AnEHHcbswpbtVEKYzlSu0Ar0Dc7vRWM/IyQdIkBHAQQAQgABgUCWj1S oAAKCRAvPIc2gF+NosIsB/9f/29FNla3BJfGIEIDnhrqGD0i9bSa89SqBd++uG06 TQgW5wsqtNcrwn81yZTq6XE6i9VtD4GKfqC0d4KZJr9bnbeD81cI64VOdL8zJWJs 0vj5EIXCobKyX74Kb4uePUyZqwT2Q74I116u/HwA9/FXsPo5isbh4ZqD4t0VHpWk mfq1FPT9a/JPyX46qKqB2Fce/7Qy+SQP1NfkuUlbhUH/JG9aSSYvk3lznNiH41x9 M+FDlL106itXOubrl3oi2fT3fsSedq7uzt+IV0DQEeNaoQAUuwEhdB8IWOMqN2wo DjGVKJftfsSWY9ilZrnDBNDrp0vRqcx33LUMkIw4d7iBiQIzBBABCAAdFiEEfhcK BFyEz0YOK3mgEO952f2DUxIFAlu3JJwACgkQEO952f2DUxJjuw/6ApHSsVTWD4a0 H6FJ23A9Ftpy+aXZ4vYlzkSrfsn2ECrEfK3lXQh/uzwjJUDYZeB1/BQsFZtcYNQO JSSHbQ49BFRLwb1J/wBZG4bbmrkLxnNbKDKQvzxEpclkMW0Dj0J6o7kGrmzIGGrh B+JJN99AcineHRug8ZSFIERRCmigxdhAKU0BFD7P+5HNHltSL3DF1c2fFOf2JrgB KVoE+9RhMZjWNbYetFFLCkjXb5Rpay9zeMm1DxfSTGAnuOwUXW6qq4hnl5+VC/48 ceDZElLLfu7RQUZv44pkSTOWZs+iQoJiHMFHk9wPqyB2Vok1yJ2a2j27WhXrJlPw nZbgJO5RyWDG3p/eVmpl5Uuc2dsfIpR17KnAuWpghK6V+cyFncDoGCl/YG2Mvool sW08FiZh3Ej4dnJjj25TZkeFG74JJDXLvMYpJfSBGnmETv4Dhcm2xPqVMuFuL1qJ lMbVLrMo2GXeo03OzNyvbs+u8WLIaGm5hC7N1CXY8wZs4jo6OJ/expvnc07dEuws 4zT3AiWv3nIouWReRStZy9QkavDocqbyPmilcdPCYk4BsOlzpwwO74hNG7iyl0Kd AlwTxGQ7y0rJou6HYa1TmRhIEr3vKvlW+JfUUrqtjXgsuacTXo4+Ira2JUErL2cY zQMq1j4r1ZyhFnuz93s7Rsx/Nw0+0YuJAZwEEAEKAAYFAlvFx+UACgkQajsROTyk rWCJqwv+NLVPE4sD4sDA2/6Ek7UsRIUkg+S39fhqWsLc4rtw/mDunv8Un61I3K04 fZ2Ry4nF9hZM0a710UvXFbStvrzRJO3EAAcdJR9LTCd19e8UeruQbIee3YT91U4N kC9JMpecfq62/teOAU2e5P3fWYaLs5ZX7zCLwWuBcW2l3SyoljQczM85HhJ3XHm+ FnwQ6D9xRle+lvWTcuC9d1yAyUb8IOospcL2lJTmy8e3r79R24hPlSB4LDe0wEN8 AXbagrcAQZjwyaHyWxjJbTwZ0b43WGdfIqZ1ElOeoffbketPGRmWvx5xUvb2ALFB BdETzV270gs5XDJgJ1SIIKOyDADxwvroTe2jD8C/841eEql5QSow3s/U3zRqk3mt tto8Qw/DN71aeh6dmYSsvd2UjsHw/vofOPRBGxZLEkKTEvMnhmMW9hiKPkPia+Qg evYE020qpKSxLEdWA8nprHwxmGiDNesCfXSC6vm1qfyj5g8HzxSckq9ZaMhKMCo7 vxflUEDuuQINBFo9UDIBEAD6DdHQfMav8OXfhjTteoarOrlJTSdci727xiezGPuB HmpvceBRZgRasdbaMc4HJee+R9+5x/nLPCuy/DxDyIjwIUeJNgc+l7LjI9WfpHTD 8U4xxjvR5Mi7+ToQQUOUNuzT0O0pyuxP1uY3RehHEhOVfBZO59ipSeZL5iQC6T5M sK1SKfs51pLa5ToC1rc8tBJ4zZmxRAyZiYc/AH2uZ/6rYjTTkAn1DVI9DYo2D/zE 4bGjXdJW5pKphFB2lX3dG4I7ODi+5e1H6A/QpCu6z8/ZkIQ+9T1xcX/YwiFeA7Pb TuW/eITbMbI1eV3+fyym9aT7Rsflmp31Zxtr+sZwGGZf00ooMBFmqOS//NUQ/Vf3 vDUew1h5QU1yDaWT3NApvi+XWPH9TPy6TMfZA2FThHf11sX/gDBa5JWQZbptPEcm oazpiKZt91CrFPOaoXDPck/Q61dfmr/oPikfByYnASIM3OwEuXqyQ9JDRfKrem5r +oA/wxWb5jELElAhOpnyqMMvOh7uz1foUssL8MAv2TGXmxpVJ8Nu4je6wf96Z22f Q0D38zud+CKH3bMP3ayXXJBcdPoENrzFbWP5FTg/4TTDJ3vOAHZR5iCunYghx8b7 Ffa4UbkwlD+dh8GiIAtvT51Ac0cO0Wc0Zjc57zPUz1zloMbf+zb1Bsn7DuEQoqj1 gwARAQABiQIlBBgBCAAPBQJaPVAyAhsMBQkJlCYAAAoJEFqy+vF7FyvqrC8P/1tF 6TeR83xD6MasqXyrBjwcLmziaF0Mlkj8k/YUiZ/knb53n97xQnh9yxPv0TT8Wpfd n3BmvqGyh8+ouHX9jMOxiRkMdNhIauVYY/8jmRfBSYWcFkfMzdYasvdLtmYJgx25 2HKTFdeOrszoOjWjEzwmh+tca3AFMu/nB++/KAmi5UJV7zsZ7uYJ5jm97LV5SLjN JIXXM+lHqCDrjDaDhNczmq1LCRlU6/WDjvkuwaVhZG4lXxMDrvKnXMkjseQ2oKjw rIdfQM86H1z5J31lfhqop+of0cimcIsBgSCPu+h96LHuAzeRBCbDKeqrfZtAZAGs okRina9947fRWxXHh3O66ILmXKNRxxWbDkPvYnQWUat8SbSTDoPWrDIGDRIAypqY o3pcN2OE0C1chqgDZQxkr+9kYZQpupOAN2TR+fM7JvbO9coKI8Uqog8CopoMeDQk d0YjcqlB1E0svODHTzcSoRzogDBYDqNLP7qVkNXpcOAXSVioBgiSDf7o5RdS/qmU yXBIeq6I5z8xBcd+BQ/n/9Frkm6K7IKP3ngUP4wEoiPx5ZE5+fPIScGmVUcZIMhk vMvem9XXh1yyhqN14gfjmLwPGdWbrgG8QUe0s2WeWIyss6uTiyF+ZbJSo2XOKVc3 YFMVUUfgyudqAV1wWdZinUk+H3pkqOKoHAy/8fST =3DYzQY -----END PGP PUBLIC KEY BLOCK----- --------------0F37BE24531AAD3F2C739CD9-- --2zXS64xYf7KOmmCSQlYzq0IFBH0Tjm4jb-- --wVNsEw9a3ItGRnlhv94mO8TegkpLGImH0 Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEW7Wm6ldl0sWGPK4nWrL68XsXK+oFAl0TmUgACgkQWrL68XsX K+oiNQ/+LtcnPxZTpnGcNGagfEFvGgo6f4CwDYCv/e/B6Rtb5lPT81V4kfDj6JJ1 Ucegu5aiiSppdsWSAsSYwhI9iCLadICEbCIJAAOTfBBpSwbwLY9WsZ2HWV7Kf1Va 5c3zlbCl1YD+wQsdT1AP9BT5HhiAfwBw4agH35Qh2hH/xHbyKDffecOgds2iEXJj FmlzP/L9iCWtKfRNMoKSH0NZ63bRs8f4qp6fxSyI2Ng+fU5ZQsI33NZFw4HY2g2Z bDIBrzGAgwHchBshOdWANmSYsDqZb+ps3KkoZbTQ8VKx4KJpHT1HCxcKfTbqL9Ec 4Uoe75p+8JohYJUZaf2ZdE4ItVZDsCFne46PHQ4N/KWrhyDQgw7XWsy7FHAbqB7J jiJrhxTCHx5MtyP//O0XDVtMn88MmlgVDP7JYVUugSag/8qfH0tF9WoFxheC2oUc qVXb3/p5Mo4ng/OsaKDH5cRT/LRq2pCdEBuipEX7lPi5V1GLdlZzn1hMDE77hp3f 4G6qmrvaZh61RlFZwb4dNXt0NjIhybPAfFjHxFnUcr+YxkqR/uujvehfuAvyXcJz vZ69L4qYcLR15yrifIBWT6IlLPgz6qRgHOwCTDfueDpdNApXm3EYeABv5NKVlUjz GGj1NSWN9NBcVNoSEIiHWgFUKDWokpfWhq3yy/cysb5+UlnE8Lc= =aE/0 -----END PGP SIGNATURE----- --wVNsEw9a3ItGRnlhv94mO8TegkpLGImH0-- From nobody Wed Jun 26 10:15:44 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 08021120157 for ; Wed, 26 Jun 2019 10:15:43 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.6 X-Spam-Level: X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H2=-0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id uo9nqJU5jUEd for ; Wed, 26 Jun 2019 10:15:41 -0700 (PDT) Received: from mx43-out1.antispamcloud.com (mx43-out1.antispamcloud.com [138.201.61.189]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5D83D1200FE for ; Wed, 26 Jun 2019 10:15:41 -0700 (PDT) Received: from [66.113.192.14] (helo=xsmtp11.mail2web.com) by mx62.antispamcloud.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.89) (envelope-from ) id 1hgBWF-0000bY-34 for tls@ietf.org; Wed, 26 Jun 2019 19:15:39 +0200 Received: from [10.5.2.12] (helo=xmail02.myhosting.com) by xsmtp11.mail2web.com with esmtp (Exim 4.63) (envelope-from ) id 1hgBU5-00060K-Gf for tls@ietf.org; Wed, 26 Jun 2019 13:13:26 -0400 Received: (qmail 30308 invoked from network); 26 Jun 2019 17:13:22 -0000 Received: from unknown (HELO [192.168.1.103]) (Authenticated-user:_huitema@huitema.net@[172.56.42.223]) (envelope-sender ) by xmail02.myhosting.com (qmail-ldap-1.03) with ESMTPA for ; 26 Jun 2019 17:13:21 -0000 To: Stephen Farrell , Michael Richardson Cc: "tls@ietf.org" References: <7374648a-d684-87be-0807-219bc10793ac@cs.tcd.ie> <18514.1561564689@localhost> From: Christian Huitema Openpgp: preference=signencrypt Autocrypt: addr=huitema@huitema.net; prefer-encrypt=mutual; keydata= mQENBFIRX8gBCAC26usy/Ya38IqaLBSu33vKD6hP5Yw390XsWLaAZTeQR64OJEkoOdXpvcOS HWfMIlD5s5+oHfLe8jjmErFAXYJ8yytPj1fD2OdSKAe1TccUBiOXT8wdVxSr5d0alExVv/LO I/vA2aU1TwOkVHKSapD7j8/HZBrqIWRrXUSj2f5n9tY2nJzG9KRzSG0giaJWBfUFiGb4lvsy IaCaIU0YpfkDDk6PtK5YYzuCeF0B+O7N9LhDu/foUUc4MNq4K3EKDPb2FL1Hrv0XHpkXeMRZ olpH8SUFUJbmi+zYRuUgcXgMZRmZFL1tu6z9h6gY4/KPyF9aYot6zG28Qk/BFQRtj7V1ABEB AAG0J0NocmlzdGlhbiBIdWl0ZW1hIDxodWl0ZW1hQGh1aXRlbWEubmV0PokBOQQTAQIAIwUC UhFfyAIbLwcLCQgHAwIBBhUIAgkKCwQWAgMBAh4BAheAAAoJEJNDCbJVyA1yhbYH/1ud6x6m VqGIp0JcZUfSQO8w+TjugqxCyGNn+w/6Qb5O/xENxNQ4HaMQ5uSRK9n8WKKDDRSzwZ4syKKf wbkfj05vgFxrjCynVbm1zs2X2aGXh+PxPL/WHUaxzEP7KjYbLtCUZDRzOOrm+0LMktngT/k3 6+EZoLEM52hwwpIAzJoscyEz7QfqMOZtFm6xQnlvDQeIrHx0KUvwo/vgDLK3SuruG1CSHcR0 D24kEEUa044AIUKBS3b0b8AR7f6mP2NcnLpdsibtpabi9BzqAidcY/EjTaoea46HXALk/eJd 6OLkLE6UQe1PPzQC4jB7rErX2BxnSkHDw50xMgLRcl5/b1a5AQ0EUhFfyAEIAKp7Cp8lqKTV CC9QiAf6QTIjW+lie5J44Ad++0k8gRgANZVWubQuCQ71gxDWLtxYfFkEXjG4TXV/MUtnOliG 5rc2E+ih6Dg61Y5PQakm9OwPIsOx+2R+iSW325ngln2UQrVPgloO83QiUoi7mBJPbcHlxkhZ bd3+EjFxSLIQogt29sTcg2oSh4oljUpz5niTt69IOfZx21kf29NfDE+Iw56gfrxI2ywZbu5o G+d0ZSp0lsovygpk4jK04fDTq0vxjEU5HjPcsXC4CSZdq5E2DrF4nOh1UHkHzeaXdYR2Bn1Y wTePfaHBFlvQzI+Li/Q6AD/uxbTM0vIcsUxrv3MNHCUAEQEAAYkCPgQYAQIACQUCUhFfyAIb LgEpCRCTQwmyVcgNcsBdIAQZAQIABgUCUhFfyAAKCRC22tOSFDh1UOlBB/94RsCJepNvmi/c YiNmMnm0mKb6vjv43OsHkqrrCqJSfo95KHyl5Up4JEp8tiJMyYT2mp4IsirZHxz/5lqkw9Az tcGAF3GlFsj++xTyD07DXlNeddwTKlqPRi/b8sppjtWur6Pm+wnAHp0mQ7GidhxHccFCl65w uT7S/ocb1MjrTgnAMiz+x87d48n1UJ7yIdI41Wpg2XFZiA9xPBiDuuoPwFj14/nK0elV5Dvq 4/HVgfurb4+fd74PV/CC/dmd7hg0ZRlgnB5rFUcFO7ywb7/TvICIIaLWcI42OJDSZjZ/MAzz BeXm263lHh+kFxkh2LxEHnQGHCHGpTYyi4Z3dv03HtkH/1SI8joQMQq00Bv+RdEbJXfEExrT u4gtdZAihwvy97OPA2nCdTAHm/phkzryMeOaOztI4PS8u2Ce5lUB6P/HcGtK/038KdX5MYST Fn8KUDt4o29bkv0CUXwDzS3oTzPNtGdryBkRMc9b+yn9+AdwFEH4auhiTQXPMnl0+G3nhKr7 jvzVFJCRif3OAhEm4vmBNDE3uuaXFQnbK56GJrnqVN+KX5Z3M7X3fA8UcVCGOEHXRP/aubiw Ngawj0V9x+43kUapFp+nF69R53UI65YtJ95ec4PTO/Edvap8h1UbdEOc4+TiYwY1TBuIKltY 1cnrjgAWUh/Ucvr++/KbD9tD6C8= Message-ID: Date: Wed, 26 Jun 2019 10:13:08 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:60.0) Gecko/20100101 Thunderbird/60.7.2 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="gIRn5EzJHPAecJ3XzmdTWQcDNRhLPX61w" X-Originating-IP: 66.113.192.14 X-Spampanel-Domain: xsmtpout.mail2web.com X-Spampanel-Username: 66.113.192.14 Authentication-Results: antispamcloud.com; auth=pass smtp.auth=66.113.192.14@xsmtpout.mail2web.com X-Spampanel-Outgoing-Class: unsure X-Spampanel-Outgoing-Evidence: Combined (0.11) X-Recommended-Action: accept X-Filter-ID: Mvzo4OR0dZXEDF/gcnlw0Ud2CCyxmm2KHETL0VYw/ASpSDasLI4SayDByyq9LIhVrc2SxE9pNZDG ErgofKLb0kTNWdUk1Ol2OGx3IfrIJKywOmJyM1qr8uRnWBrbSAGDoOWO0i/H75teRGzF9TgV+efH zJ6mVE7ewsipSVIfs4avdweczmNomLVBsjb+AzIVk4hYVdSH4ilEX20H0GUoaCNjDPJzy/pY6GXD jinexCWZ3JKVmi72ocgY5kMQSjs7M7F7B+H4BOgiABPpiHhZId0M1NgpAM2NwqA2XimSsrj58/mr R3YJqKPtWOxo96AGbE5d/K7AdzmETkpmCtG845uv8+AJAs5OVVdGw7jzTmkPN6zV1i63NRPS95Qa zrdAxHhaG8a6cKotmFuikgQDTaUsT9OFUpjIFjDduQiJ6VhM3iIROxK9avuhN3JnLgS3DkvqOqBJ 9aVrZUoYpWrLEnGcecvnQdm/JLWjfH3wiRVsJe5ihH8+GrMkZTXyCNtMHuUCcH3gfGjK7M5vIGbB 4Ck4xAm9D8KTeKJT7gNACPdf22VzvjZVumvddWyl4okY6Z15kL45NrNm7a+6LGMNFCcF0nekcc7B cSt5SM0VNdjBCmhbbCq3hyQo9URXeCyGB5hQ6nsDvccjqgmDvD9Wh+WR/i26M8i/BRyXA9o1Cprq LJmyBFmzP8/pV+rk1GoSb9tZ+C5yOc2YAGkaEP1NO/Jhg8B4nm3RdGNDa3lYa0pSEPL0KP26CBC8 NaWqPu+iW/ab6m5yOl0OE0Zc3yar9wShBHx/bGEBjcTl+Rg1K5xRXxKF5tPxTxfD0dMN+t5ZpLtj 3xz/YVO7dPwX9Na6YCqHrJ+RfComsJFdhSHVgOsSlc7QH2wrg4VsasGqauP7RRW2l+1H4O6n35Um 71OcejWV/AGXOg0SkH1AIpdD9myJ+cv73CChOPjKA0/DVd83PCmA5ULvt7VaAji2RhOscFoNJq7X lAj1SApo6dRtXFYwyGTHIAoNFX+jcW7DGmdEmoVd39t86NHFuZHIzn9QZA== X-Report-Abuse-To: spam@quarantine9.antispamcloud.com Archived-At: Subject: Re: [TLS] publishing ESNIKeys under a .well-known URI... X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 26 Jun 2019 17:15:43 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --gIRn5EzJHPAecJ3XzmdTWQcDNRhLPX61w Content-Type: multipart/mixed; boundary="cI4CE0klis9HAihyacKznRjiJxYXiUeRr"; protected-headers="v1" From: Christian Huitema To: Stephen Farrell , Michael Richardson Cc: "tls@ietf.org" Message-ID: Subject: Re: [TLS] publishing ESNIKeys under a .well-known URI... References: <7374648a-d684-87be-0807-219bc10793ac@cs.tcd.ie> <18514.1561564689@localhost> In-Reply-To: --cI4CE0klis9HAihyacKznRjiJxYXiUeRr Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Content-Language: en-US On 6/26/2019 9:11 AM, Stephen Farrell wrote: > Hiya, > > On 26/06/2019 16:58, Michael Richardson wrote: >> Stephen Farrell wrote: >> > My web server doesn't have an API it can use to update >> > ESNIKeys in the DNS. Many implementations/deployments may >> > have such an API but in my case, the zone file that >> > includes the ESNIKeys RR is on another machine and the >> > web server doesn't have write access to that. I do >> > control both machines as it happens, but I still don't >> > want to give general write-access to the web server. >> >> When you say, "general write-access", did you mean that you didn't wan= t to >> setup Dynamic DNS to be able to update the QNAMEs involved, because th= at >> usually permits the web server to delete A and AAAA records, as well a= s >> updating the ESNI ? >> >> Or did you mean "general write-access", meaning NFS or something like = that? > Both really. NFS, or scripting up something with ssh, > would be easy but isn't desirable for local reasons. > DDNS seemed like more work, (but I didn't check it out > in detail tbh), wouldn't be otherwise useful in my > setup, and yes would need an authorisation model that > doesn't exist at the moment in our setup. > > Like I said, what I did won't be needed everywhere, but > maybe it's useful enough to document properly and/or > standardise, not sure. I think Stephen's issue will be quite common, especially for small sites. I may be wrong, but it is quite common for small sites to use a DNS provider's management UI to update DNS data. This will create a de-facto limit on how often they can update the ESNIKeys RR, and thus the key itself. But then, we should ask how often these sites need to update the ESNI key. I understand one part of the threat model, that attackers can use an old compromised private key to break the privacy of clients using the old public key, hence the need to refresh the keys reasonably often. But there is a flip side of that. If the TTL of the ESNI record is small, clients will need frequent DNS interactions to refresh it, and their privacy could also be compromised during these operations. So, there are two threats: compromised keys on one side, observable DNS transactions on the other side. How do we navigate between these two threats? -- Christian Huitema --cI4CE0klis9HAihyacKznRjiJxYXiUeRr-- --gIRn5EzJHPAecJ3XzmdTWQcDNRhLPX61w Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQEcBAEBCAAGBQJdE6euAAoJELba05IUOHVQ5HAIAJHl2yhuySOL/I1dzCt3eMfJ zV6ofLwwmtaqknNJSPeKuD7C5z8ZqWSSYC7yX1M0CLFA++oZZyXGaBx6tr9IlAE6 WhiENbynz1JebbgxInJnpaaWZ8TpntnNC/PWqBuyuKrJSk9u+EyYWyFEz8jXIers T0+wwy/Ba/5FyjRQ9llM+ZigLaGmraMIeXcS5ycC2o/3qKnVuLMVuFcyaLnGvH+c C+YogQvai2T0TYMr3XKuSFWqg2posAK3ueouHUg2qAZ9XupCMlxCHurtRFu19l7l IvUk/Df8WLDFSNt0rnmgO/ecVwJ9iTHs/Bg4s8s+eQuJseJTV5T5aPKA6X5Tx4A= =CXan -----END PGP SIGNATURE----- --gIRn5EzJHPAecJ3XzmdTWQcDNRhLPX61w-- From nobody Wed Jun 26 10:32:26 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5CF8512030F for ; Wed, 26 Jun 2019 10:32:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=sn3rd.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JshUKQHs4K1H for ; Wed, 26 Jun 2019 10:32:22 -0700 (PDT) Received: from mail-qt1-x831.google.com (mail-qt1-x831.google.com [IPv6:2607:f8b0:4864:20::831]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 14EB6120303 for ; Wed, 26 Jun 2019 10:32:17 -0700 (PDT) Received: by mail-qt1-x831.google.com with SMTP id y57so3285520qtk.4 for ; Wed, 26 Jun 2019 10:32:17 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sn3rd.com; s=google; h=from:content-transfer-encoding:mime-version:subject:date:references :to:in-reply-to:message-id; bh=ccpHZ1JQZ1nJTfpjqQvMBLesNIjKcN3vIo/Rn6cmGDs=; b=HpT9ex/p45rygWE4YPKlSDkg+BnBeIJk4hpJHZf4rjDvu/5yDKtvkFlVgYHyWvu9ku VqqYbgDjjoOP5/ppcJy/t7fH4W9mzi/JpiR6pykEcH/DW/c0heV4goPedjR78hCDzKiE dqmiZ9fX0zuXbyOuTEwBOHfuELHElU80m4jzU= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:content-transfer-encoding:mime-version :subject:date:references:to:in-reply-to:message-id; bh=ccpHZ1JQZ1nJTfpjqQvMBLesNIjKcN3vIo/Rn6cmGDs=; b=jGiPGVE1T/JjAu5x79Qowh0mCvhs9ePzB86jnn6evrv5TXTaFcPp/2QGPKD/WEfQ/P f+CsxMigJ6qZBG881H8bGqbJcuxJB7wkXB3vvsd2K3YzLZs15O9DpfOjVdFZWzMBxXPM /zCgBpKr1Lzx+PrMj2B9tkUGfwEng4Yke2WjWHajbsS96qHBdvKwKFVCIJniGekiLhTY DiWwiq3HlV+XEMDVL8WGRsAgR5emr5bn3qY80JlBsuJNJUR/4cIitPU2kopAYwQwiJyl GTEMrW9+8ogpWgW1U7XpEka/0EQCg/OaESkcWY8wWa6yaMSdZid8jdksnTR9cO/BtfUd azoA== X-Gm-Message-State: APjAAAXqyDQJ4I/18qvxxG1K9rYhCXYA5pXbvwFVU68j+UZqSciez65i LVeeODYEGCofHGD8M5GJeu5Pondtm6o= X-Google-Smtp-Source: APXvYqyo91DRQB0r4h8vgWfNCBZ5hSvEc+EUl8m/PfdJSK3NoE+3QK6ro/Z8i9wDlpNsgo2L1AxLLg== X-Received: by 2002:ac8:2e59:: with SMTP id s25mr4815781qta.94.1561570336046; Wed, 26 Jun 2019 10:32:16 -0700 (PDT) Received: from ?IPv6:2601:151:4501:12ca:387e:c72:6b68:357? ([2601:151:4501:12ca:387e:c72:6b68:357]) by smtp.gmail.com with ESMTPSA id x2sm8800486qkc.92.2019.06.26.10.32.14 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 26 Jun 2019 10:32:15 -0700 (PDT) From: Sean Turner Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Wed, 26 Jun 2019 13:32:13 -0400 References: To: TLS List In-Reply-To: Message-Id: <34DC165A-B219-418D-8609-C63424E912C7@sn3rd.com> X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [TLS] IANA Considerations for draft-ietf-tls-dtls-connection-id X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 26 Jun 2019 17:32:25 -0000 While these IANA points are minor, what is being considered here affects = all TLS registries so please let us know what you think about the = proposal for the following issue: Issue: The IANA DEs (Designated Experts) think that the registry should = indicate that the connection_id is DTLS-Only. This is the first = extension defined that would need this marking. Currently, there is no = =E2=80=9CDTLS-Only=E2=80=9D column in the TLS ExtensionType Values = registry nor is there a "DTLS-OK" column like there are in the TLS = Parameter registries [0]. Note none of the TLS extension registries [1] = have a "DTLS-OK=E2=80=9D column. Proposals (there might be more): 0. Do nothing 1. Add a note to the top of the registry that says connection_id is = DTLS-Only 2. Add a DTLS-Only column to the TLS ExtensionType Values registry and = mark this one Y and all others N 3. Think about the future (inspired by Achiem in the GH repo): - Change the =E2=80=9CDTLS-OK=E2=80=9D column to "TLS/DTLS=E2=80=9D. = Allow values of TLS, DTLS, or TLS/DTLS. - Mark all DTLS-OK=3DY rows to =E2=80=9CTLS/DTLS=E2=80=9D and all = DTLS-OK=3DN to =E2=80=9CTLS=E2=80=9D. [2] - Add =E2=80=9CTLS/DTLS=E2=80=9D column to the TLS ExtensionType Values = registry and mark the connection_id extension as =E2=80=9CDTLS" and all = others as =E2=80=9CTLS/DTLS". Selection: While option 3 is the most work it does kind of future proof the = registries and would make the columns the same in the parameter and = extensions registry groupings. spt [0] https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml [1] = https://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontyp= e-values.xhtml [2] Most of the DTLS-OK=3DN are deprecated cipher suites, but a couple = of Exporter Labels are also marked as DTLS-OK=3DN. > On Jun 20, 2019, at 21:46, Sean Turner wrote: >=20 > All, >=20 > During the DE=E2=80=99s review of the assignments for = draft-ietf-tls-dtls-connection-id, they requested a new =E2=80=9CDTLS = Only=E2=80=9D column be added to the TLS ExtensionType Values registry. = This connection_id would be the only =E2=80=9CY=E2=80=9D and all others = there now would be =E2=80=9CN=E2=80=9D. >=20 > The chairs also noted that the IANA considerations in = draft-ietf-tls-dtls-connection-id needs to specify values for all the = columns for connection_id in the TLS ExtensionType Values registry and = tls12_cid in the TLS ContentType registry. Here are the proposed = values: >=20 > connection_id > TLS 1.3 column: =E2=80=9C-=E2=80=9C it is not applicable to TLS = 1.3 > Recommended: =E2=80=9CY" >=20 > tls12_cid > DTLS-OK: =E2=80=9CY=E2=80=9D >=20 > This has been captured in the following PR: > https://github.com/tlswg/dtls-conn-id/pull/67 >=20 > Obviously, please comment. >=20 > spt From nobody Wed Jun 26 10:35:25 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 18CF012031E for ; Wed, 26 Jun 2019 10:35:19 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.701 X-Spam-Level: X-Spam-Status: No, score=-2.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=akamai.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Zh2xfqEy-SGG for ; Wed, 26 Jun 2019 10:35:17 -0700 (PDT) Received: from mx0b-00190b01.pphosted.com (mx0b-00190b01.pphosted.com [IPv6:2620:100:9005:57f::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9DB0C12030F for ; Wed, 26 Jun 2019 10:35:17 -0700 (PDT) Received: from pps.filterd (m0122330.ppops.net [127.0.0.1]) by mx0b-00190b01.pphosted.com (8.16.0.27/8.16.0.27) with SMTP id x5QHWDJx015591; Wed, 26 Jun 2019 18:35:16 +0100 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=akamai.com; h=from : to : subject : date : message-id : references : in-reply-to : content-type : content-id : content-transfer-encoding : mime-version; s=jan2016.eng; bh=En2iceNeo0aXa8H+OQpNgJWA42KCNbhKqoCqxv0C7Pw=; b=ZtXrChNWENlZJjxBi9OWz9QUgES639CNpPZXJdtOGBwv8QivWqh81qsEpVVKKdjpNp9s 9sY5788dFTVXlTDUmXxcUAwkaMGL6G8UyqqIFIEpqT7k42m1jkj1CPL4XD72auJu+UaW MLztDAVb8V6pNz4vRLukpZhK9J8YTzqJL9DqXyCNMqdjHudBbA8lLnY5/wuae/wSnGE0 9OugGo8oqVXoxPuDVjgyKP0Z3xxO7KSDh9Ct0XFAwiRRBPw3qOlDsqQZb9OaPCLuF9oU 3Ddc+gno4ej7Xh3fCenb2nx2gKX3YT/0XtvumqncK6vwUDz0VzSnIqsKOpY3ZVgWMiDR eA== Received: from prod-mail-ppoint1 (prod-mail-ppoint1.akamai.com [184.51.33.18] (may be forged)) by mx0b-00190b01.pphosted.com with ESMTP id 2tba50estm-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 26 Jun 2019 18:35:16 +0100 Received: from pps.filterd (prod-mail-ppoint1.akamai.com [127.0.0.1]) by prod-mail-ppoint1.akamai.com (8.16.0.27/8.16.0.27) with SMTP id x5QHWN5f000754; Wed, 26 Jun 2019 13:35:15 -0400 Received: from email.msg.corp.akamai.com ([172.27.123.34]) by prod-mail-ppoint1.akamai.com with ESMTP id 2tccwp05np-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-SHA384 bits=256 verify=NOT); Wed, 26 Jun 2019 13:35:15 -0400 Received: from USMA1EX-DAG1MB1.msg.corp.akamai.com (172.27.123.101) by usma1ex-dag1mb4.msg.corp.akamai.com (172.27.123.104) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Wed, 26 Jun 2019 13:35:04 -0400 Received: from USMA1EX-DAG1MB1.msg.corp.akamai.com ([172.27.123.101]) by usma1ex-dag1mb1.msg.corp.akamai.com ([172.27.123.101]) with mapi id 15.00.1473.004; Wed, 26 Jun 2019 13:35:04 -0400 From: "Salz, Rich" To: Sean Turner , TLS List Thread-Topic: [TLS] IANA Considerations for draft-ietf-tls-dtls-connection-id Thread-Index: AQHVJ9M8OcMtUDLH60W4+usGlPOS8qaufZWA//+9vYA= Date: Wed, 26 Jun 2019 17:35:03 +0000 Message-ID: References: <34DC165A-B219-418D-8609-C63424E912C7@sn3rd.com> In-Reply-To: <34DC165A-B219-418D-8609-C63424E912C7@sn3rd.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.1a.0.190609 x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [172.19.35.217] Content-Type: text/plain; charset="utf-8" Content-ID: <7F625F885308F6499E3C529CBF17F4E2@akamai.com> Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2019-06-26_09:, , signatures=0 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 suspectscore=0 malwarescore=0 phishscore=0 bulkscore=0 spamscore=0 mlxscore=0 mlxlogscore=698 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1810050000 definitions=main-1906260206 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2019-06-26_09:, , signatures=0 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 priorityscore=1501 malwarescore=0 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1011 lowpriorityscore=0 mlxscore=0 impostorscore=0 mlxlogscore=744 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1810050000 definitions=main-1906260207 Archived-At: Subject: Re: [TLS] IANA Considerations for draft-ietf-tls-dtls-connection-id X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 26 Jun 2019 17:35:19 -0000 U29tZXRoaW5nIHNob3VsZCBiZSBkb25lLCBJIGRvbid0IGhhdmUgYSBzdHJvbmcgcHJlZmVyZW5j ZSBmb3IgMiBvciAzLiAgSGF2aW5nIHRoaXMgaW5mbyBiYWNrIHRoZW4gbWlnaHQgaGF2ZSBwcmV2 ZW50ZWQgSGVhcnRibGVlZC4NCg0K From nobody Wed Jun 26 11:55:18 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 95F971205FF for ; Wed, 26 Jun 2019 11:55:17 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.499 X-Spam-Level: X-Spam-Status: No, score=-17.499 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id lxh_yEQKBP06 for ; Wed, 26 Jun 2019 11:55:15 -0700 (PDT) Received: from mail-ot1-x331.google.com (mail-ot1-x331.google.com [IPv6:2607:f8b0:4864:20::331]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 94C95120629 for ; Wed, 26 Jun 2019 11:55:07 -0700 (PDT) Received: by mail-ot1-x331.google.com with SMTP id e8so3604853otl.7 for ; Wed, 26 Jun 2019 11:55:07 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=vmISDnMpW0YCy10Di4kmfLbjZulKnedG5ppxRIK3s+o=; b=v/ShMFgmd+/ECUBWjix81UjZM1fwVT5DDpX2xGg2DN5MundkjFGO0x/AI4Sm8RzJQt Xgv0nfcxShg3suDMuQQjroO3iCMcWWr3fxXIHi/ciFj+5jAIdJtCVBgYImcSQkpsqc3O ktl+6e93fRTBOeqfVJuyvPm5FeK0h6aZ02pKLW+ij98wk/9VPk85if5K3qNdl66Ndbth xuBHdfd4jsxB1Vrh6BoGtqUXKyX9QR1fyOq+nziWrw6B/K+3dMTc8WxQM2sz67pgZFWL MZK1NRrGC5xzM7X2swmk/0uOUIxV3eYw9IUamMQbaV5u+vR/UhxrJn+dp18x4P4m0bpB cO0w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=vmISDnMpW0YCy10Di4kmfLbjZulKnedG5ppxRIK3s+o=; b=VjAbHf39ShpSSAd2JFUW75kwCaUOhLT6HmZlHje/ocsO6B6Dcy3Sk/XMr/OpZmlAc7 7ubPf1s5PUnG4Mxa2T4ceLN1oKIiPm+He2EyFNeIKbpIIS7ro+pAph5dxvuJJdnTkqWL osd2+n7tR8yjPm13EeK2DcO8ECL6axHkzlTX0nz+lBb6kszTHOkDBQdFcuhZWZTmwIjv fw0+9Kw285DSMxumORRCRZKubhURbkgw3MF9VjYulYmoS69L3QpF3JSQaxEcnd9SUdK6 acj5V4JhHxBJbSVDdVKnIK1Afu5/poFjMNo31pJ1ysJFPzDvAe+681EPoEpRVUh0+G9R XewQ== X-Gm-Message-State: APjAAAVexYJQ6fCWlVKdppNcxBxw/YJEBJCn+be0qUNhXoS2Dnu+ocoO r4vbZCtWgsZDF+2WMkNjJ6I9Z+jKfxZA8rAAmN8nWA== X-Google-Smtp-Source: APXvYqwVSbQ6Tm0OqLOMCT1jW2zTkc1wg0NQQNof/qsCw9P4pmfmfyl4ckXnV8pH6qEFzeiL3eMK8XExOR1mNTl0rRc= X-Received: by 2002:a05:6830:1596:: with SMTP id i22mr4514837otr.93.1561575306548; Wed, 26 Jun 2019 11:55:06 -0700 (PDT) MIME-Version: 1.0 References: <34DC165A-B219-418D-8609-C63424E912C7@sn3rd.com> In-Reply-To: From: Nick Harper Date: Wed, 26 Jun 2019 11:54:55 -0700 Message-ID: To: "Salz, Rich" Cc: Sean Turner , TLS List Content-Type: multipart/alternative; boundary="000000000000706b70058c3e956f" Archived-At: Subject: Re: [TLS] IANA Considerations for draft-ietf-tls-dtls-connection-id X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 26 Jun 2019 18:55:18 -0000 --000000000000706b70058c3e956f Content-Type: text/plain; charset="UTF-8" I have a slight preference for 3. On Wed, Jun 26, 2019 at 10:35 AM Salz, Rich wrote: > Something should be done, I don't have a strong preference for 2 or 3. > Having this info back then might have prevented Heartbleed. > > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls > --000000000000706b70058c3e956f Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
I have a slight preference for 3.

On Wed, Jun 26, 2019 at 1= 0:35 AM Salz, Rich <rsalz@akamai.com= > wrote:
= Something should be done, I don't have a strong preference for 2 or 3.= =C2=A0 Having this info back then might have prevented Heartbleed.

_______________________________________________
TLS mailing list
TLS@ietf.org
https://www.ietf.org/mailman/listinfo/tls
--000000000000706b70058c3e956f-- From nobody Wed Jun 26 13:44:30 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7C99E1203A8 for ; Wed, 26 Jun 2019 13:44:28 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1RoG-vbSx5CM for ; Wed, 26 Jun 2019 13:44:26 -0700 (PDT) Received: from mail-lj1-x22d.google.com (mail-lj1-x22d.google.com [IPv6:2a00:1450:4864:20::22d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2700B1203A6 for ; Wed, 26 Jun 2019 13:44:26 -0700 (PDT) Received: by mail-lj1-x22d.google.com with SMTP id 131so3613246ljf.4 for ; Wed, 26 Jun 2019 13:44:26 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=D211I/v77rBpaAbL67CJX/pLc6cCaxP88K3pX2uAJEc=; b=ZSRGoAllqxoxG+WErJZlyZI8QO+hUeTTnSzQwx6oxewq6zm3nY1mGuv5kn25DmDhuY r4xiEV3cXz6XBbLjjhwbKDN7dQPMhTwY2JXzXYbHoHzAfRZyHzphHY+AABebqtTKxEcF /xEnazMTfinNRk6DGvXaBzg4786jZnB0HOw6Imbu0539q67t09HwkREq7JrqDpnCrrIm knWij/rKxP/jo3O+023b0cJ9UTeCesVjQ31mDbYzgFFBOG7qhCr30DM2+Yq2zMgak8hV 0Uj0ym7dEr6rCvajXdb2vywpPvgNvieX0dVfBlSsRac3NIw2J5EhEpjTh02J8kGTOI26 vOdw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=D211I/v77rBpaAbL67CJX/pLc6cCaxP88K3pX2uAJEc=; b=ahGitKp+3g8rzSjbzCnmf9uwg/UEumsDMZssZuePgQ+TAcCkKxTCCSQn9Sbid0HOKT kIAuNJiPEfWsZ6ZqMGhr5zLx9WI0xnEXc4JDhXTW3OBuN2my51rGnQknC5C2yRno5hCd e/6tt2mq6ukLz92rfTmdh9z/FT0F/0vU9XWA3ZCKxaaaFbk6siUj5wsDjR/l9kYsk30s /vQ6yWTUkP/M8PlOS5LvKY5w4e8bEOB/hqr1ttcBFn/0QYC1x6R+4Oz9/cpAUwuuux2r 99/L78R2zPRd3+ajxxquLP3FvTZhp+cKHAqqvx1vQpILI2uR+Pd/jBEpzRdHp1lGTez8 SgZg== X-Gm-Message-State: APjAAAWfrZhmr2Oe3Qsoh0dYvKhCzmo9NhUbsQi3vmQRzqGZOXTZEYLH H9A+8f5Y4zu7UcIQDTE+VcQE4LkGhpvCRHKMuh4= X-Google-Smtp-Source: APXvYqyWcjMssjPX/xaNby4xdHcdh0E8aEbUP/deT8WPhXlFx6wMkU1xLliEVv/JqXw4X9jXgKTf/VYpohPX/wbNBog= X-Received: by 2002:a2e:7c15:: with SMTP id x21mr139204ljc.55.1561581864272; Wed, 26 Jun 2019 13:44:24 -0700 (PDT) MIME-Version: 1.0 References: <34DC165A-B219-418D-8609-C63424E912C7@sn3rd.com> In-Reply-To: From: Watson Ladd Date: Wed, 26 Jun 2019 13:44:12 -0700 Message-ID: To: Nick Harper Cc: "Salz, Rich" , TLS List Content-Type: text/plain; charset="UTF-8" Archived-At: Subject: Re: [TLS] IANA Considerations for draft-ietf-tls-dtls-connection-id X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 26 Jun 2019 20:44:28 -0000 I think we need to do 3, especially with QUIC. Are we sure they won't want extensions? On Wed, Jun 26, 2019 at 11:55 AM Nick Harper wrote: > > I have a slight preference for 3. > > On Wed, Jun 26, 2019 at 10:35 AM Salz, Rich wrote: >> >> Something should be done, I don't have a strong preference for 2 or 3. Having this info back then might have prevented Heartbleed. >> >> _______________________________________________ >> TLS mailing list >> TLS@ietf.org >> https://www.ietf.org/mailman/listinfo/tls > > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls -- "Man is born free, but everywhere he is in chains". --Rousseau. From nobody Wed Jun 26 18:27:17 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BD42C120094 for ; Wed, 26 Jun 2019 18:27:15 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.701 X-Spam-Level: X-Spam-Status: No, score=-2.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=lowentropy.net header.b=mPk5ds/B; dkim=pass (2048-bit key) header.d=messagingengine.com header.b=XWL75ZLx Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WUwOm6VToZr2 for ; Wed, 26 Jun 2019 18:27:13 -0700 (PDT) Received: from out1-smtp.messagingengine.com (out1-smtp.messagingengine.com [66.111.4.25]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3AA521200B7 for ; Wed, 26 Jun 2019 18:27:13 -0700 (PDT) Received: from compute1.internal (compute1.nyi.internal [10.202.2.41]) by mailout.nyi.internal (Postfix) with ESMTP id 56008200E3 for ; Wed, 26 Jun 2019 21:27:12 -0400 (EDT) Received: from imap2 ([10.202.2.52]) by compute1.internal (MEProxy); Wed, 26 Jun 2019 21:27:12 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=lowentropy.net; h=mime-version:message-id:in-reply-to:references:date:from:to :subject:content-type:content-transfer-encoding; s=fm2; bh=uXUDL DYoSbUY1WmkwujTgy2fGnG4uLo3vgMVR2OVxqU=; b=mPk5ds/BUqv9ODQ/4BtG3 o63BHw5xcbVonT0IbXp/2RzKbVy7WffrSBxzZ2+HeR5SNoj9ZR+b9OnDI/oB4Rvq 48k0Ex+EJp3WqI8la19+INy6rR8891AG9EolsIwWzpT4Fl/2h5HOUTxy1iHmBcr/ Pp7dnQFq2IIjFKRU6isstLQ8dBjKejtanTfYcUPxINuK7+yvdvGlLa9qgCsuYIz5 M6fCEvFJSme2BWirBGz5q7+pKTR3dEk/UsJLYFLNvhLn6kC/Q9w7LX9MqPxvNDeV 3tkcO6FPHhq0c9ZSQjP+vmsHXwTxXihWpHvuJ+66jKNJvpZiO6wgCYSdOm0/AgZP Q== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=content-transfer-encoding:content-type :date:from:in-reply-to:message-id:mime-version:references :subject:to:x-me-proxy:x-me-proxy:x-me-sender:x-me-sender :x-sasl-enc; s=fm3; bh=uXUDLDYoSbUY1WmkwujTgy2fGnG4uLo3vgMVR2OVx qU=; b=XWL75ZLxYj66UUdE1eDxgpyewbWyQyzFyPoTvJQPujFBySx+IU10MTI0G UB9x3iSrql3x3EEKkzGyTi6mlYPEqP2qQUGgnG/YVj1YvPkCp7PND1lr/btRWETU LmCzpIdyYn0m4SP5KhfDJyJE37B6CnjRQXBInNW2jgj54SeOXXOa9cCrvTVxAeQf 1z/SHGzRzKIUDjgWBxm0TrT28VdjZa1SDnRsexV5DBO8SlwOxhD6bk+yaq7y2gfD bItukQnnVqkdWbOvBvmr0en0W7xY5je5W3wtboKdqPZ+RrftLuLZKceZWFtuTnNY N8uU/NCvPJ7IkbgsxHbKuTkvWm1yA== X-ME-Sender: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgeduvddrudejgdegkecutefuodetggdotefrodftvf curfhrohhfihhlvgemucfhrghsthforghilhdpqfgfvfdpuffrtefokffrpgfnqfghnecu uegrihhlohhuthemuceftddtnecunecujfgurhepofgfggfkjghffffhvffutgfgsehtqh ertderreejnecuhfhrohhmpedfofgrrhhtihhnucfvhhhomhhsohhnfdcuoehmtheslhho figvnhhtrhhophihrdhnvghtqeenucfrrghrrghmpehmrghilhhfrhhomhepmhhtsehloh ifvghnthhrohhphidrnhgvthenucevlhhushhtvghrufhiiigvpedt X-ME-Proxy: Received: by mailuser.nyi.internal (Postfix, from userid 501) id AF525E00A2; Wed, 26 Jun 2019 21:27:11 -0400 (EDT) X-Mailer: MessagingEngine.com Webmail Interface User-Agent: Cyrus-JMAP/3.1.6-730-g63f2c3b-fmstable-20190622v1 Mime-Version: 1.0 Message-Id: In-Reply-To: <34DC165A-B219-418D-8609-C63424E912C7@sn3rd.com> References: <34DC165A-B219-418D-8609-C63424E912C7@sn3rd.com> Date: Thu, 27 Jun 2019 11:27:12 +1000 From: "Martin Thomson" To: tls@ietf.org Content-Type: text/plain;charset=utf-8 Content-Transfer-Encoding: quoted-printable Archived-At: Subject: Re: [TLS] IANA Considerations for draft-ietf-tls-dtls-connection-id X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 27 Jun 2019 01:27:16 -0000 On Thu, Jun 27, 2019, at 03:32, Sean Turner wrote: > The IANA DEs (Designated Experts) think that the registry should=20 > indicate that the connection_id is DTLS-Only. This is the first=20 > extension defined that would need this marking. Currently, there is n= o=20 > =E2=80=9CDTLS-Only=E2=80=9D column in the TLS ExtensionType Values reg= istry nor is=20 > there a "DTLS-OK" column like there are in the TLS Parameter registrie= s=20 > [0]. Note none of the TLS extension registries [1] have a "DTLS-OK=E2= =80=9D=20 > column. Let's look at something less interesting than this, like the use_srtp ex= tension. The current conception of that is DTLS-Only, but it turns out = that it makes a lot of sense to negotiate that in QUIC, which is essenti= ally TLS and not DTLS. It's fairly simple to update the IANA registry w= hen defining the new usage, but that can be done by adding a reference t= o a new document. So for me the question is how much detail you need to capture in the reg= istries as opposed to the spec. The spec can capture a ton of nuance th= at the registry can't. We won't ever manage to tabulate all the propert= ies of registered values; so the question is whether there is some value= in having that information available in this form. I can't see that he= re. Worse, if we say DTLS-OK=3DN for an extension, is that a license to kill= a connection if a client offers that extension? The same applies to an= y codepoint that might be so restricted. That would prevent the use of = use_srtp in QUIC, so we'd need a new codepoint if we wanted the same sem= antics. That's a strictly worse situation than where we are today. I strongly prefer doing nothing. p.s., I went through the registries and the ones listed below with an X don't = - in my opinion - need the DTLS-OK column. In all of these - except as = noted - all registered values have a Y as far as I can see. So my view = is that only the cipher suites need the column, and only for historical = reasons that no longer apply to any suite we might newly define. X TLS ClientCertificateType Identifiers TLS Cipher Suites X TLS ContentType X TLS Alerts X TLS HandshakeType - why is EOED marked DTLS-OK when it is prohibite= d? X TLS Supported Groups X TLS EC Point Formats X TLS EC Curve Types X TLS Supplemental Data Formats (SupplementalDataType) X TLS UserMappingType Values X TLS SignatureAlgorithm X TLS HashAlgorithm ? TLS Exporter Labels - this uses the DTLS-OK=3DN heavily, but that i= s because the usage for those exporters is in TLS and never DTLS, there = is no inherent reason for the column to be present X TLS Authorization Data Formats X TLS Heartbeat Message Types X TLS Heartbeat Modes N/A TLS SignatureScheme - no column N/A TLS PskKeyExchangeMode From nobody Wed Jun 26 18:33:03 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 47B121203D1 for ; Wed, 26 Jun 2019 18:33:01 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.701 X-Spam-Level: X-Spam-Status: No, score=-2.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=akamai.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id AT_qFDi3Ke_B for ; Wed, 26 Jun 2019 18:33:00 -0700 (PDT) Received: from mx0a-00190b01.pphosted.com (mx0a-00190b01.pphosted.com [IPv6:2620:100:9001:583::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1A960120288 for ; Wed, 26 Jun 2019 18:33:00 -0700 (PDT) Received: from pps.filterd (m0050095.ppops.net [127.0.0.1]) by m0050095.ppops.net-00190b01. (8.16.0.27/8.16.0.27) with SMTP id x5R1WxOE010911; Thu, 27 Jun 2019 02:32:59 +0100 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=akamai.com; h=from : to : subject : date : message-id : references : in-reply-to : content-type : content-id : content-transfer-encoding : mime-version; s=jan2016.eng; bh=BiyaAcRRgdLXWjU57mLFglRUOfCgN4ueQMwu/rT8sNY=; b=Jtj0+5aMsSc5jfXMFLIpCD45O1dlQE9Veh8CYCxjCjsui7OL88vRIEecHngndi7OBrsg g7pZN3MZxZvDbRE/18d5+2khHKNKUYcoLlNBK2RQYv1J+tcUj6yiGI2szry3ktBpyJNk TaybVgnrthyhJB199HtPADjDuUfsIOMN0EPBMlc1TULZi6pU8Uhu8R59/7vTbOQRVIfp ZhCzuGeyqc+gIrFJj/cegZA5DnPy9kwX6hUSLbK3XjWX8r+RyKv1mepeC3hDD9SMNqh2 nzM5v6Htmui4uhuf8/cW7Q3eyQir7SMMrsVLGlGeN7SncOZ5f8byn79tzoi/I6K5ZtUP 0Q== Received: from prod-mail-ppoint1 (prod-mail-ppoint1.akamai.com [184.51.33.18] (may be forged)) by m0050095.ppops.net-00190b01. with ESMTP id 2tcf2dh088-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 27 Jun 2019 02:32:59 +0100 Received: from pps.filterd (prod-mail-ppoint1.akamai.com [127.0.0.1]) by prod-mail-ppoint1.akamai.com (8.16.0.27/8.16.0.27) with SMTP id x5R1Vp2W008168; Wed, 26 Jun 2019 21:32:58 -0400 Received: from email.msg.corp.akamai.com ([172.27.123.33]) by prod-mail-ppoint1.akamai.com with ESMTP id 2tccwp4ede-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-SHA384 bits=256 verify=NOT); Wed, 26 Jun 2019 21:32:58 -0400 Received: from USMA1EX-DAG1MB1.msg.corp.akamai.com (172.27.123.101) by usma1ex-dag1mb1.msg.corp.akamai.com (172.27.123.101) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Wed, 26 Jun 2019 21:32:57 -0400 Received: from USMA1EX-DAG1MB1.msg.corp.akamai.com ([172.27.123.101]) by usma1ex-dag1mb1.msg.corp.akamai.com ([172.27.123.101]) with mapi id 15.00.1473.004; Wed, 26 Jun 2019 21:32:57 -0400 From: "Salz, Rich" To: Martin Thomson , "tls@ietf.org" Thread-Topic: [TLS] IANA Considerations for draft-ietf-tls-dtls-connection-id Thread-Index: AQHVJ9M8OcMtUDLH60W4+usGlPOS8qaufZWAgACEtgD//76LgA== Date: Thu, 27 Jun 2019 01:32:56 +0000 Message-ID: <31CE7B50-C603-4296-A9A4-336CE6A20DB1@akamai.com> References: <34DC165A-B219-418D-8609-C63424E912C7@sn3rd.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.1a.0.190609 x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [172.19.33.3] Content-Type: text/plain; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2019-06-26_14:, , signatures=0 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 suspectscore=0 malwarescore=0 phishscore=0 bulkscore=0 spamscore=0 mlxscore=0 mlxlogscore=834 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1810050000 definitions=main-1906270016 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2019-06-26_14:, , signatures=0 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 priorityscore=1501 malwarescore=0 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1015 lowpriorityscore=0 mlxscore=0 impostorscore=0 mlxlogscore=878 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1810050000 definitions=main-1906270016 Archived-At: Subject: Re: [TLS] IANA Considerations for draft-ietf-tls-dtls-connection-id X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 27 Jun 2019 01:33:01 -0000 PiAgICBMZXQncyBsb29rIGF0IHNvbWV0aGluZyBsZXNzIGludGVyZXN0aW5nIHRoYW4gdGhpcywg bGlrZSB0aGUgdXNlX3NydHAgZXh0ZW5zaW9uLg0KDQpObywgbGV0J3Mgc3RpY2sgd2l0aCB0aGUg aW50ZXJlc3RpbmcgY2FzZSBiZWZvcmUgdXMgYmVjYXVzZSwgd2VsbCwgaXQgc2hvd3MgYSBwcm9i bGVtLiAgV2UgaGF2ZSBhIHByb2JsZW0gYW5kIGxhY2sgb2YgY2xhcml0eSBpbiB0aGUgcmVnaXN0 cmllcywgd2hpY2ggY2FuIGV2ZW4gYmUgbWlzbGVhZGluZy4gWWVzIHRoZSBzcGVjIGlzIGRlZmlu aXRpdmUsIGFuZCBtYXliZSBhIHByb2xvZyBpbiBlYWNoIFRMUyByZWdpc3RyeSBzaG91bGQgc3Rh dGUgdGhhdC4gIEJ1dCBpbXBsZW1lbnRvcnMgYW5kIHJldmlld2VycyBzb21ldGltZXMgbmVlZCBh IGNoZWNrbGlzdC4NCiANCg0K From nobody Wed Jun 26 19:26:45 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 51F9C1200E0 for ; Wed, 26 Jun 2019 19:26:44 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.701 X-Spam-Level: X-Spam-Status: No, score=-2.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=lowentropy.net header.b=r7Nkf6yb; dkim=pass (2048-bit key) header.d=messagingengine.com header.b=vGquk9am Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id B1oS8EjdbOTX for ; Wed, 26 Jun 2019 19:26:43 -0700 (PDT) Received: from out2-smtp.messagingengine.com (out2-smtp.messagingengine.com [66.111.4.26]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DDF3F1203D1 for ; Wed, 26 Jun 2019 19:26:42 -0700 (PDT) Received: from compute1.internal (compute1.nyi.internal [10.202.2.41]) by mailout.nyi.internal (Postfix) with ESMTP id 26FE82203E; Wed, 26 Jun 2019 22:26:42 -0400 (EDT) Received: from imap2 ([10.202.2.52]) by compute1.internal (MEProxy); Wed, 26 Jun 2019 22:26:42 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=lowentropy.net; h=mime-version:message-id:in-reply-to:references:date:from:to :subject:content-type; s=fm2; bh=jKTtv3K6Di4SOWAIfCWlXDTbaPsVm0X 1M6eolVAXp+U=; b=r7Nkf6ybgHQHImpMQu6A/Iw/TwEWN3bGqjxQKBNsFjQYSsl LYHsFS5qHE6oNZct3rWnRZ3CaKErkM43phWTxGcSAdNn6N3xTF9SAX36GAFRIbnv C+p2jx/e/P0/pXtn/bHuUUTmE5Yk+hjr7Rruq4iZSVHOKqgloXyEyv2M0mVyj2+L NXgCOzT+fJDC288qvZRGN8RTt31a6qFDdBOD7fuoqIL9qzxYEDONhI/AQ1nt0+yB XFTq0BlBM3AIFc239wC8MAThI6Gb4ZTIq1aFN4eze5iifno81eKJQRuxrUwhXNQs TwYAE6Wej98yyNHIajUSdj9y5TRTAfGeLKodkqw== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to:x-me-proxy :x-me-proxy:x-me-sender:x-me-sender:x-sasl-enc; s=fm3; bh=jKTtv3 K6Di4SOWAIfCWlXDTbaPsVm0X1M6eolVAXp+U=; b=vGquk9amL3RvrDyR/uJFjt FwhxQn4jB5q8vwHzThaztjpoo70DKTYjAc4zgmMK+RpG63xRhhlfpvYC5kS53Rz/ vs8/1oVs+m8F1SZBfo2ytqUhSPGNeR5ZuESxC+BAC9vobxVHgyQZJDz1q4+/v0yC q+fUP4x08gZLeM4eS7HxQFY3UeUp5oP+6+4ERDsohwYVE9BEImgY9Imygj65UyHj tt8JulqNFXfrm8exbKW3aqNIPjosU/cBWCLNSWm2eDLI2QuZzsp+eV+HPYG0K+9m hG2sLzDAHPS4zcqSKIgNMtSq0gtPOZAJEP6scO7dhfdkeaS0vCb1HjdmJ6Bt8fwg == X-ME-Sender: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgeduvddrudejgdeitdcutefuodetggdotefrodftvf curfhrohhfihhlvgemucfhrghsthforghilhdpqfgfvfdpuffrtefokffrpgfnqfghnecu uegrihhlohhuthemuceftddtnecusecvtfgvtghiphhivghnthhsucdlqddutddtmdenuc fjughrpefofgggkfgjfhffhffvufgtsehttdertderredtnecuhfhrohhmpedfofgrrhht ihhnucfvhhhomhhsohhnfdcuoehmtheslhhofigvnhhtrhhophihrdhnvghtqeenucfrrg hrrghmpehmrghilhhfrhhomhepmhhtsehlohifvghnthhrohhphidrnhgvthenucevlhhu shhtvghrufhiiigvpedt X-ME-Proxy: Received: by mailuser.nyi.internal (Postfix, from userid 501) id 93E1BE00A2; Wed, 26 Jun 2019 22:26:41 -0400 (EDT) X-Mailer: MessagingEngine.com Webmail Interface User-Agent: Cyrus-JMAP/3.1.6-730-g63f2c3b-fmstable-20190622v1 Mime-Version: 1.0 Message-Id: <1bdc2510-a4e6-45eb-a51d-ff2a6f04cc56@www.fastmail.com> In-Reply-To: <31CE7B50-C603-4296-A9A4-336CE6A20DB1@akamai.com> References: <34DC165A-B219-418D-8609-C63424E912C7@sn3rd.com> <31CE7B50-C603-4296-A9A4-336CE6A20DB1@akamai.com> Date: Thu, 27 Jun 2019 12:26:42 +1000 From: "Martin Thomson" To: "Salz, Rich" , "tls@ietf.org" Content-Type: text/plain Archived-At: Subject: Re: [TLS] IANA Considerations for draft-ietf-tls-dtls-connection-id X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 27 Jun 2019 02:26:44 -0000 On Thu, Jun 27, 2019, at 11:33, Salz, Rich wrote: > No, let's stick with the interesting case before us because, well, it > shows a problem. We have a problem and lack of clarity in the > registries, which can even be misleading. Yes the spec is definitive, > and maybe a prolog in each TLS registry should state that. But > implementors and reviewers sometimes need a checklist. Sure, but in this case, there is a potential for collateral. Do you think that is not an important consideration? From nobody Thu Jun 27 03:43:11 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BA975120153 for ; Thu, 27 Jun 2019 03:43:09 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id LO_9nsCpdW-4 for ; Thu, 27 Jun 2019 03:43:07 -0700 (PDT) Received: from mail-yw1-xc30.google.com (mail-yw1-xc30.google.com [IPv6:2607:f8b0:4864:20::c30]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0FA03120125 for ; Thu, 27 Jun 2019 03:43:07 -0700 (PDT) Received: by mail-yw1-xc30.google.com with SMTP id s5so1159834ywd.9 for ; Thu, 27 Jun 2019 03:43:07 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=pOWTGsLsBnppjlcmQDrwR2XEJVrzWiqqVLm9xRZPVlQ=; b=rCeMCf7IzT2FzTnJGx+kX71zQrbIvJ0g9/Z5jIV/D0r0xeuQxh3HGmT5Wuv1mtIzSp fDU3oo+CtU40vB7jWwTnuHsZ61yT67SeuASWlIPFSjvXIrF6KtDe33uMRkc7dJGv8SWL nEeIOSOfwLfyYmL7VpPWfxz+8y4omao+VX2b51X4Sgw6ROBWRE6K8VRkchpzlgWO6LGT HzTuGa019sNtMJRmwaDeBg6REaMP2Cp1PInE9nqB81bhRBr0+YP8yWR2Zxnyn+geH9Bp SctYD/0q5gkQlHPGziKhACQgVV6Ta2I55dElkZZ1XKJbbFpye/Lb80VGVP76wuu2yZYn kXNA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=pOWTGsLsBnppjlcmQDrwR2XEJVrzWiqqVLm9xRZPVlQ=; b=CvFONpIsaB12ohRudOwNLbiLeMIMmyt88SCnk4GpAlmYlrQcYOz2PN0BYp4Aa5ULZH ZtYI1zieZ89xUu7x1K52pwiUmFLgMkHZM0zypA8CaGKyjbb8o2sOBVgaczMaBzALvx6M P0+Bx/GNN0FQOMmHMPInMW33n2qIrYicgtrzlog2SPKNQohHcvaf79NnviX0Sd/iauUT rAB8ovKY8TS9HLeORR8tHK3YZs7lYdYsA3VlW9hZV9zZwq6wH4vi8x+AF1ciwL9LmP3w 36xL/qIHC7lyTlZQYAZf2eidB0ulw208U+/gbelEFR3DLPVniNAYTOtjhJf4gZK4yk3f KYYw== X-Gm-Message-State: APjAAAWqgCAvQV9Gg2wrLx5XYkuDsh0NuAPTi3IAbmsaSNkh+KCr4fAo 2cz5mwPzOVI63RqsqmkolQN/XG3Wy+pMCtLzrNE= X-Google-Smtp-Source: APXvYqxhT/6FK/t6WWR49EVQAeVZpqsGlI+qBgKHuTiQ0/iqU9LkN0AsXXuYIAnZw2Lrzuj49eSLLloGaCas79XI+as= X-Received: by 2002:a81:af52:: with SMTP id x18mr1838005ywj.289.1561632186230; Thu, 27 Jun 2019 03:43:06 -0700 (PDT) MIME-Version: 1.0 References: <34DC165A-B219-418D-8609-C63424E912C7@sn3rd.com> In-Reply-To: <34DC165A-B219-418D-8609-C63424E912C7@sn3rd.com> From: Ira McDonald Date: Thu, 27 Jun 2019 06:44:20 -0400 Message-ID: To: Sean Turner , Ira McDonald Cc: TLS List Content-Type: multipart/alternative; boundary="000000000000baeede058c4bd332" Archived-At: Subject: Re: [TLS] IANA Considerations for draft-ietf-tls-dtls-connection-id X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 27 Jun 2019 10:43:10 -0000 --000000000000baeede058c4bd332 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Hi, I strongly prefer option 3. The future-proofing and avoidance of a proliferation of new columns in the IANA registries is paramount. The points about QUIC highlight the near-term need to clean up this this issue. Cheers, - Ira Ira McDonald (Musician / Software Architect) Co-Chair - TCG Trusted Mobility Solutions WG Co-Chair - TCG Metadata Access Protocol SG Chair - Linux Foundation Open Printing WG Secretary - IEEE-ISTO Printer Working Group Co-Chair - IEEE-ISTO PWG Internet Printing Protocol WG IETF Designated Expert - IPP & Printer MIB Blue Roof Music / High North Inc http://sites.google.com/site/blueroofmusic http://sites.google.com/site/highnorthinc mailto: blueroofmusic@gmail.com PO Box 221 Grand Marais, MI 49839 906-494-2434 On Wed, Jun 26, 2019 at 1:32 PM Sean Turner wrote: > While these IANA points are minor, what is being considered here affects > all TLS registries so please let us know what you think about the proposa= l > for the following issue: > > > Issue: > > The IANA DEs (Designated Experts) think that the registry should indicate > that the connection_id is DTLS-Only. This is the first extension define= d > that would need this marking. Currently, there is no =E2=80=9CDTLS-Only= =E2=80=9D column in > the TLS ExtensionType Values registry nor is there a "DTLS-OK" column lik= e > there are in the TLS Parameter registries [0]. Note none of the TLS > extension registries [1] have a "DTLS-OK=E2=80=9D column. > > > Proposals (there might be more): > > 0. Do nothing > > 1. Add a note to the top of the registry that says connection_id is > DTLS-Only > > 2. Add a DTLS-Only column to the TLS ExtensionType Values registry and > mark this one Y and all others N > > 3. Think about the future (inspired by Achiem in the GH repo): > > - Change the =E2=80=9CDTLS-OK=E2=80=9D column to "TLS/DTLS=E2=80=9D. All= ow values of TLS, DTLS, > or TLS/DTLS. > > - Mark all DTLS-OK=3DY rows to =E2=80=9CTLS/DTLS=E2=80=9D and all DTLS-OK= =3DN to =E2=80=9CTLS=E2=80=9D. [2] > > - Add =E2=80=9CTLS/DTLS=E2=80=9D column to the TLS ExtensionType Values r= egistry and mark > the connection_id extension as =E2=80=9CDTLS" and all others as =E2=80=9C= TLS/DTLS". > > > Selection: > > While option 3 is the most work it does kind of future proof the > registries and would make the columns the same in the parameter and > extensions registry groupings. > > > spt > > [0] https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml > [1] > https://www.iana.org/assignments/tls-extensiontype-values/tls-extensionty= pe-values.xhtml > [2] Most of the DTLS-OK=3DN are deprecated cipher suites, but a couple of > Exporter Labels are also marked as DTLS-OK=3DN. > > > On Jun 20, 2019, at 21:46, Sean Turner wrote: > > > > All, > > > > During the DE=E2=80=99s review of the assignments for > draft-ietf-tls-dtls-connection-id, they requested a new =E2=80=9CDTLS Onl= y=E2=80=9D column > be added to the TLS ExtensionType Values registry. This connection_id wou= ld > be the only =E2=80=9CY=E2=80=9D and all others there now would be =E2=80= =9CN=E2=80=9D. > > > > The chairs also noted that the IANA considerations in > draft-ietf-tls-dtls-connection-id needs to specify values for all the > columns for connection_id in the TLS ExtensionType Values registry and > tls12_cid in the TLS ContentType registry. Here are the proposed values: > > > > connection_id > > TLS 1.3 column: =E2=80=9C-=E2=80=9C it is not applicable to TLS 1= .3 > > Recommended: =E2=80=9CY" > > > > tls12_cid > > DTLS-OK: =E2=80=9CY=E2=80=9D > > > > This has been captured in the following PR: > > https://github.com/tlswg/dtls-conn-id/pull/67 > > > > Obviously, please comment. > > > > spt > > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls > --000000000000baeede058c4bd332 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hi,

I strongly prefer option= 3.=C2=A0 The future-proofing and avoidance of a
proliferation of= new columns in the IANA registries is paramount.
The points abou= t QUIC highlight the near-term need to clean up
this this issue.<= br>

Cheers,
- Ira

Ira McDonald (Musician / Software Architect)
Co-Chair= - TCG Trusted Mobility Solutions WG
Co-Chair - TCG Metadata Acce= ss Protocol SG
Chair - Linux Foundation Open Prin= ting WG
Secretary - IEEE-ISTO Printer Working Group
Co-Chair - IEEE-I= STO PWG Internet Printing Protocol WG
IETF Designated Expert - IPP &= Printer MIB
Blue Roof Music / High North Inc
http://sites.google.com/site/blueroofmusic
http://sites.google.com/site/highnorthinc
mailto: blueroofmusic@gmail.c= om
PO Box 221=C2=A0 Grand Marais, MI 49839=C2=A0 906-494-2434

On Wed, = Jun 26, 2019 at 1:32 PM Sean Turner <s= ean@sn3rd.com> wrote:
While these IANA points are minor, what is being considered he= re affects all TLS registries so please let us know what you think about th= e proposal for the following issue:


Issue:

The IANA DEs (Designated Experts) think that the registry should indicate t= hat the connection_id=C2=A0 is DTLS-Only.=C2=A0 This is the first extension= defined that would need this marking.=C2=A0 Currently, there is no =E2=80= =9CDTLS-Only=E2=80=9D column in the TLS ExtensionType Values registry nor i= s there a "DTLS-OK" column like there are in the TLS Parameter re= gistries [0].=C2=A0 Note none of the TLS extension registries [1] have a &q= uot;DTLS-OK=E2=80=9D column.


Proposals (there might be more):

0. Do nothing

1. Add a note to the top of the registry that says connection_id is DTLS-On= ly

2. Add a DTLS-Only column to the TLS ExtensionType Values registry and mark= this one Y and all others N

3. Think about the future (inspired by Achiem in the GH repo):

- Change the =E2=80=9CDTLS-OK=E2=80=9D column to "TLS/DTLS=E2=80=9D.= =C2=A0 Allow values of TLS, DTLS, or TLS/DTLS.

- Mark all DTLS-OK=3DY rows to =E2=80=9CTLS/DTLS=E2=80=9D and all DTLS-OK= =3DN to =E2=80=9CTLS=E2=80=9D. [2]

- Add =E2=80=9CTLS/DTLS=E2=80=9D column to the TLS ExtensionType Values reg= istry and mark the connection_id extension as =E2=80=9CDTLS" and all o= thers as =E2=80=9CTLS/DTLS".


Selection:

While option 3 is the most work it does kind of future proof the registries= and would make the columns the same in the parameter and extensions regist= ry groupings.


spt

[0] https://www.iana.org/assignm= ents/tls-parameters/tls-parameters.xhtml
[1] https://= www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.= xhtml
[2] Most of the DTLS-OK=3DN are deprecated cipher suites, but a couple of E= xporter Labels are also marked as DTLS-OK=3DN.

> On Jun 20, 2019, at 21:46, Sean Turner <sean@sn3rd.com> wrote:
>
> All,
>
> During the DE=E2=80=99s review of the assignments for draft-ietf-tls-d= tls-connection-id, they requested a new =E2=80=9CDTLS Only=E2=80=9D column = be added to the TLS ExtensionType Values registry. This connection_id would= be the only =E2=80=9CY=E2=80=9D and all others there now would be =E2=80= =9CN=E2=80=9D.
>
> The chairs also noted that the IANA considerations in draft-ietf-tls-d= tls-connection-id needs to specify values for all the columns for connectio= n_id in the TLS ExtensionType Values registry and tls12_cid in the TLS Cont= entType registry.=C2=A0 Here are the proposed values:
>
> connection_id
>=C2=A0 =C2=A0 =C2=A0 =C2=A0TLS 1.3 column: =E2=80=9C-=E2=80=9C it is no= t applicable to TLS 1.3
>=C2=A0 =C2=A0 =C2=A0 =C2=A0Recommended: =E2=80=9CY"
>
> tls12_cid
>=C2=A0 =C2=A0 =C2=A0 =C2=A0DTLS-OK: =E2=80=9CY=E2=80=9D
>
> This has been captured in the following PR:
> https://github.com/tlswg/dtls-conn-id/pull/67<= br> >
> Obviously, please comment.
>
> spt

_______________________________________________
TLS mailing list
TLS@ietf.org
https://www.ietf.org/mailman/listinfo/tls
--000000000000baeede058c4bd332-- From nobody Thu Jun 27 05:14:21 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 241C5120273 for ; Thu, 27 Jun 2019 05:14:20 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.701 X-Spam-Level: X-Spam-Status: No, score=-2.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=akamai.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Y5qERxxwdN_o for ; Thu, 27 Jun 2019 05:14:18 -0700 (PDT) Received: from mx0a-00190b01.pphosted.com (mx0a-00190b01.pphosted.com [IPv6:2620:100:9001:583::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DBFDB1200C5 for ; Thu, 27 Jun 2019 05:14:18 -0700 (PDT) Received: from pps.filterd (m0122332.ppops.net [127.0.0.1]) by mx0a-00190b01.pphosted.com (8.16.0.27/8.16.0.27) with SMTP id x5RCCkT4031876; Thu, 27 Jun 2019 13:14:18 +0100 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=akamai.com; h=from : to : subject : date : message-id : references : in-reply-to : content-type : content-id : content-transfer-encoding : mime-version; s=jan2016.eng; bh=O7IOnd0+/MOquLO3GM4VR9VMKfxRZJODn+txqchc/2Q=; b=D4VIS0tkugDCnFauna0kKtgS8djmdz4/xWleiCV+mk0IUh56NPnv0pSMDCd3P5CqCS7/ vNO9iuArDcNuVPduV/8nw3oDWVWFXkVvdvcCxidfUi1VwD+XWL+Up7RJKbdLUNKdjXqi CvxU8uzgNzlrJ066LVrpeIekaRxFvn3UjHkgzj+dC+dox8D7NziMa8ivPX9Y+IZzjq8K D1MhOBLiM5pgCMaVssJ5Zadrk5CHKSTTFoCgbpm0a2JvnKhUs3DhJpkvNDpyDIJVtax4 LzqS23hcguU2yPrTecLamY1MOKUqlWKvlMVzLQt+pmE3S+eIYbFOrEFx0FEAL/xo3YfL pA== Received: from prod-mail-ppoint2 (prod-mail-ppoint2.akamai.com [184.51.33.19] (may be forged)) by mx0a-00190b01.pphosted.com with ESMTP id 2tcfr02ndp-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 27 Jun 2019 13:14:18 +0100 Received: from pps.filterd (prod-mail-ppoint2.akamai.com [127.0.0.1]) by prod-mail-ppoint2.akamai.com (8.16.0.27/8.16.0.27) with SMTP id x5RC2C8k022158; Thu, 27 Jun 2019 08:14:17 -0400 Received: from email.msg.corp.akamai.com ([172.27.123.30]) by prod-mail-ppoint2.akamai.com with ESMTP id 2tcdrj1rk8-2 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-SHA384 bits=256 verify=NOT); Thu, 27 Jun 2019 08:14:16 -0400 Received: from USMA1EX-DAG1MB1.msg.corp.akamai.com (172.27.123.101) by usma1ex-dag1mb2.msg.corp.akamai.com (172.27.123.102) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Thu, 27 Jun 2019 08:13:25 -0400 Received: from USMA1EX-DAG1MB1.msg.corp.akamai.com ([172.27.123.101]) by usma1ex-dag1mb1.msg.corp.akamai.com ([172.27.123.101]) with mapi id 15.00.1473.004; Thu, 27 Jun 2019 08:13:25 -0400 From: "Salz, Rich" To: Martin Thomson , "tls@ietf.org" Thread-Topic: [TLS] IANA Considerations for draft-ietf-tls-dtls-connection-id Thread-Index: AQHVJ9M8OcMtUDLH60W4+usGlPOS8qaufZWAgACEtgD//76LgIAAUhUAgABg3gA= Date: Thu, 27 Jun 2019 12:13:25 +0000 Message-ID: <505E2B6F-B1DA-4816-B5F3-30FDEC032777@akamai.com> References: <34DC165A-B219-418D-8609-C63424E912C7@sn3rd.com> <31CE7B50-C603-4296-A9A4-336CE6A20DB1@akamai.com> <1bdc2510-a4e6-45eb-a51d-ff2a6f04cc56@www.fastmail.com> In-Reply-To: <1bdc2510-a4e6-45eb-a51d-ff2a6f04cc56@www.fastmail.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.1a.0.190609 x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [172.19.34.41] Content-Type: text/plain; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2019-06-27_07:, , signatures=0 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 suspectscore=0 malwarescore=0 phishscore=0 bulkscore=0 spamscore=0 mlxscore=0 mlxlogscore=834 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1810050000 definitions=main-1906270141 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2019-06-27_07:, , signatures=0 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 priorityscore=1501 malwarescore=0 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1015 lowpriorityscore=0 mlxscore=0 impostorscore=0 mlxlogscore=871 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1810050000 definitions=main-1906270144 Archived-At: Subject: Re: [TLS] IANA Considerations for draft-ietf-tls-dtls-connection-id X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 27 Jun 2019 12:14:20 -0000 PiAgICBTdXJlLCBidXQgaW4gdGhpcyBjYXNlLCB0aGVyZSBpcyBhIHBvdGVudGlhbCBmb3IgY29s bGF0ZXJhbC4gIERvIHlvdSB0aGluayB0aGF0IGlzIG5vdCBhbiBpbXBvcnRhbnQgY29uc2lkZXJh dGlvbj8NCiAgDQpBIGNvbnNpZGVyYXRpb24geWVzLiAgQW4gaW1wb3J0YW50IG9uZSBuby4NCiAg DQoNCg== From nobody Thu Jun 27 14:41:25 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 89A5B120236 for ; Thu, 27 Jun 2019 14:41:17 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.934 X-Spam-Level: X-Spam-Status: No, score=-1.934 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_SOFTFAIL=0.665] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id J1SMmIhfKwvP for ; Thu, 27 Jun 2019 14:41:16 -0700 (PDT) Received: from mx0a-000c2a01.pphosted.com (mx0a-000c2a01.pphosted.com [148.163.151.92]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 61085120298 for ; Thu, 27 Jun 2019 14:41:15 -0700 (PDT) Received: from pps.filterd (m0128479.ppops.net [127.0.0.1]) by mx0a-000c2a01.pphosted.com (8.16.0.42/8.16.0.42) with SMTP id x5RLeApq028607 for ; Thu, 27 Jun 2019 17:41:15 -0400 Received: from fox.seas.upenn.edu (renard.seas.upenn.edu [158.130.71.129]) by mx0a-000c2a01.pphosted.com with ESMTP id 2t9j15s7aw-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Thu, 27 Jun 2019 17:41:15 -0400 Received: from mail-io1-f43.google.com (mail-io1-f43.google.com [209.85.166.43]) (authenticated bits=0) by fox.seas.upenn.edu (8.15.2/8.15.2) with ESMTPSA id x5RLfCJI011496 (version=TLSv1.2 cipher=AES256-GCM-SHA384 bits=256 verify=NOT) for ; Thu, 27 Jun 2019 17:41:13 -0400 Received: by mail-io1-f43.google.com with SMTP id h6so8142542ioh.3 for ; Thu, 27 Jun 2019 14:41:12 -0700 (PDT) X-Gm-Message-State: APjAAAVqO7XtUn8IxGGtT49l0ORnfekEQT0hVAFdpN5m9oH1oDmGOgEl s8O0nBRXDOchfUcvLVU4/QiVc/BbG0Io8FbK8LWN X-Google-Smtp-Source: APXvYqw66NkgoOhPPnWpOccquXUk9a9LT4mKG1xKbc9BOl5tGhQt5b5BpuzlX8mZG8BiL/9UESZsquaBUD2RU3DoySk= X-Received: by 2002:a5d:9282:: with SMTP id s2mr6709727iom.36.1561671667406; Thu, 27 Jun 2019 14:41:07 -0700 (PDT) MIME-Version: 1.0 From: Yishuai Li Date: Thu, 27 Jun 2019 17:40:19 -0400 X-Gmail-Original-Message-ID: Message-ID: To: tls@ietf.org Content-Type: text/plain; charset="UTF-8" X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:5.22.84,1.0.8 definitions=2019-06-27_14:2019-06-25,2019-06-27 signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 malwarescore=0 mlxlogscore=291 lowpriorityscore=0 mlxscore=0 phishscore=0 priorityscore=1501 adultscore=0 impostorscore=0 clxscore=1015 bulkscore=0 spamscore=0 suspectscore=3 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-1904300001 definitions=main-1906270248 Archived-At: Subject: [TLS] Inconsistent TLSCiphertext definition X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 27 Jun 2019 21:41:24 -0000 Dear TLS working group, RFC 8446 Section 4 Page 23 says: > Handshake messages are supplied to the TLS record layer, where they are > encapsulated within one or more TLSPlaintext or TLSCiphertext structures which > are processed and transmitted as specified by the current active connection > state. RFC 8448 Section 3 Page 8 sends a handshake record, with content type application_data (0x17). Should I read it as: "The handshake record is encapsulated within a TLSCiphertext"? 1. If yes, RFC 8446 Section 5.2 Page 80 says: > encrypted_record: The AEAD-encrypted form of the serialized > TLSInnerPlaintext structure. However, the payload does not follow the structure of TLSInnerPlaintext (RFC 8446 Section 5.2 Page 79), but that of Handshake (RFC 8446 Section 4 Page 24) instead. 2. If no, which section of RFC8446 specifies the complete record? Thanks, Yishuai Li From nobody Fri Jun 28 01:01:05 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EDF5C120163 for ; Fri, 28 Jun 2019 01:01:03 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.598 X-Spam-Level: X-Spam-Status: No, score=-2.598 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9CsCfoVt14gU for ; Fri, 28 Jun 2019 01:01:01 -0700 (PDT) Received: from welho-filter2.welho.com (welho-filter2.welho.com [83.102.41.24]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4E5C9120131 for ; Fri, 28 Jun 2019 01:01:00 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by welho-filter2.welho.com (Postfix) with ESMTP id 2ABDAC3F31; Fri, 28 Jun 2019 11:00:58 +0300 (EEST) X-Virus-Scanned: Debian amavisd-new at pp.htv.fi Received: from welho-smtp3.welho.com ([IPv6:::ffff:83.102.41.86]) by localhost (welho-filter2.welho.com [::ffff:83.102.41.24]) (amavisd-new, port 10024) with ESMTP id 5dKTT03nmG4Z; Fri, 28 Jun 2019 11:00:57 +0300 (EEST) Received: from LK-Perkele-VII (87-100-246-37.bb.dnainternet.fi [87.100.246.37]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by welho-smtp3.welho.com (Postfix) with ESMTPSA id 874D62308; Fri, 28 Jun 2019 11:00:55 +0300 (EEST) Date: Fri, 28 Jun 2019 11:00:55 +0300 From: Ilari Liusvaara To: Yishuai Li Cc: tls@ietf.org Message-ID: <20190628080054.GA2408377@LK-Perkele-VII> References: MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.10.1 (2018-07-13) Sender: ilariliusvaara@welho.com Archived-At: Subject: Re: [TLS] Inconsistent TLSCiphertext definition X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 28 Jun 2019 08:01:04 -0000 On Thu, Jun 27, 2019 at 05:40:19PM -0400, Yishuai Li wrote: > > RFC 8446 Section 4 Page 23 says: > > > Handshake messages are supplied to the TLS record layer, where they are > > encapsulated within one or more TLSPlaintext or TLSCiphertext structures which > > are processed and transmitted as specified by the current active connection > > state. > > RFC 8448 Section 3 Page 8 sends a handshake record, with content type > application_data (0x17). Should I read it as: "The handshake record is > encapsulated within a TLSCiphertext"? > > 1. If yes, RFC 8446 Section 5.2 Page 80 says: > > > encrypted_record: The AEAD-encrypted form of the serialized > > TLSInnerPlaintext structure. > > However, the payload does not follow the structure of TLSInnerPlaintext (RFC > 8446 Section 5.2 Page 79), but that of Handshake (RFC 8446 Section 4 Page > 24) instead. > > 2. If no, which section of RFC8446 specifies the complete record? The payload shown is TLSInnerPlaintext.content. It gets processed as follows: 1) 0x16 byte is appended to plaintext to yield TLSInnerPlaintext (since this is encrypted handshake message), together with 0 trailing zeroes (for padding, there could be more). 2) The TLSInnerPlaintext is AEAD-encrypted 3) The record header is prepended (with application_data type, since it is encrypted). Note that the size difference between payload and record is 22 bytes: - 5 bytes for the record header (0x17 0x03 0x03 0x02 0xa2). - 1 byte for the encrypted record type (whatever 0x16 encrypts to) - 0 bytes for padding - 16 bytes for the AES-GCM tag. Exactly matching the amount expected. -Ilari From nobody Fri Jun 28 05:27:36 2019 Return-Path: X-Original-To: tls@ietf.org Delivered-To: tls@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id E871012009E; Fri, 28 Jun 2019 05:27:34 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: Sean Turner via Datatracker To: X-Test-IDTracker: no X-IETF-IDTracker: 6.98.1 Auto-Submitted: auto-generated Precedence: bulk Cc: Sean Turner , iesg-secretary@ietf.org, tls-chairs@ietf.org, sean@sn3rd.com, tls@ietf.org Message-ID: <156172485494.20653.307396745611384846.idtracker@ietfa.amsl.com> Date: Fri, 28 Jun 2019 05:27:34 -0700 Archived-At: Subject: [TLS] Publication has been requested for draft-ietf-tls-oldversions-deprecate-05 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 28 Jun 2019 12:27:35 -0000 Sean Turner has requested publication of draft-ietf-tls-oldversions-deprecate-05 as Best Current Practice on behalf of the TLS working group. Please verify the document's state at https://datatracker.ietf.org/doc/draft-ietf-tls-oldversions-deprecate/ From nobody Fri Jun 28 09:52:35 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 772CE12044E for ; Fri, 28 Jun 2019 09:52:33 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.499 X-Spam-Level: X-Spam-Status: No, score=-17.499 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id I-Y5XHdvn6FF for ; Fri, 28 Jun 2019 09:52:30 -0700 (PDT) Received: from mail-vs1-xe32.google.com (mail-vs1-xe32.google.com [IPv6:2607:f8b0:4864:20::e32]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id F3D9E12019F for ; Fri, 28 Jun 2019 09:52:22 -0700 (PDT) Received: by mail-vs1-xe32.google.com with SMTP id k9so4486091vso.5 for ; Fri, 28 Jun 2019 09:52:22 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to; bh=kjIXiWjTLiXlibp5bAJBxT9GzGcbSt2b1nvSxdOFwWY=; b=cInyESZNnSMWeqyLz1l/Aejii6LNP3ffygqCFUcgaqcK3ELlal/PRffZfzqhKbzcpq Zco7RwAiNZdrac9QmpO+s9IcddBARJUKdMgdeOU+jBpajOKEzVCAhlMNlQdkwb9aPEXL B4wpJF93Awpu125FPzgae4HEH+7hLQi/rjIEdivOIZHyzyxCOqeTLAxUMz05e2mo/X7X T1d4w2aJ4E1fyz4Rb3IzSJh7kCZ1h54UxsrQxIuezryVjRT9CTZ8Pe7DrqQN9gR4hVbF FNJg2rkJl+zWsqgsqeEcPJxG+U45oSHJjw4c3okmWwQhfyQtRBaXxB4yqOqVfSy8r/it Ve1w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to; bh=kjIXiWjTLiXlibp5bAJBxT9GzGcbSt2b1nvSxdOFwWY=; b=fxTh+o09Dx5lJEyWn4Y6cQB993PLoXxXoGViA8+ZPb/JP990hqvl/E5JDUkl2qUQm7 WcVmX9ikK8bVEQ1Z7QLy62H7h+LBrfNV3rlAUKkydQ9qBMkvsLMRz7IxexGg43ftwSBA dGtJmamKY2CJ2/4pmOvsZUHFRGXlZeKn464WXjlvHsOWo1X9jH3cMc0sMu9X1ufhGgLb vxVy5y9vYLX1yat1djAv50/BxlB7G8yesvwT40gfqq4DRO6Oy1Z9SXX56swUE94EAbFM IuyxE08P/b6rSVSzTBPb62WxzQKyUgYyd8V2g1FppCEaZ6Zeciz99va96OX2Z2AfnOdO 7UKw== X-Gm-Message-State: APjAAAVzldMMYqvpjiRWsOVT4MCbl/NbOo6s/EmrCRgmk+AlUOhHxWLg w9yOwcsHkp3P4QN6nDCbS88Be9sy8rvyLWkSYJt4MWWY X-Google-Smtp-Source: APXvYqxpOcHYrU4V1Yj1BpIaCbqnaGID39XTuLj539daRE/IYCJ7v+xfuw/pipxENtHD/BAjQyrQSeYZ82tG/sjvCx4= X-Received: by 2002:a67:ff0a:: with SMTP id v10mr7448431vsp.1.1561740741661; Fri, 28 Jun 2019 09:52:21 -0700 (PDT) MIME-Version: 1.0 References: <156173339678.20700.10472293883370612968.idtracker@ietfa.amsl.com> In-Reply-To: <156173339678.20700.10472293883370612968.idtracker@ietfa.amsl.com> From: Ben Schwartz Date: Fri, 28 Jun 2019 12:52:10 -0400 Message-ID: To: "" Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha-256; boundary="0000000000002a5fb8058c651ab6" Archived-At: Subject: [TLS] Fwd: New Version Notification for draft-schwartz-tls-lb-00.txt X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 28 Jun 2019 16:52:34 -0000 --0000000000002a5fb8058c651ab6 Content-Type: multipart/alternative; boundary="00000000000023b6ba058c651ab6" --00000000000023b6ba058c651ab6 Content-Type: text/plain; charset="UTF-8" Hi TLS, This is a proposal for a very simple new protocol whose main purpose is to enable ESNI "split mode". Ultimately, I hope that this protocol can also enable more end-to-end TLS, by reducing the need for load-balancers to terminate TLS. Please discuss. Thanks, Ben Schwartz ---------- Forwarded message --------- A new version of I-D, draft-schwartz-tls-lb-00.txt has been successfully submitted by Benjamin M. Schwartz and posted to the IETF repository. Name: draft-schwartz-tls-lb Revision: 00 Title: TLS Metadata for Load Balancers Document date: 2019-06-28 Group: Individual Submission Pages: 8 URL: https://www.ietf.org/internet-drafts/draft-schwartz-tls-lb-00.txt Status: https://datatracker.ietf.org/doc/draft-schwartz-tls-lb/ Htmlized: https://tools.ietf.org/html/draft-schwartz-tls-lb-00 Htmlized: https://datatracker.ietf.org/doc/html/draft-schwartz-tls-lb Abstract: A load balancer that does not terminate TLS may wish to provide some information to the backend server, in addition to forwarding TLS data. This draft proposes a protocol between load balancers and backends that enables secure, efficient delivery of TLS with additional information. The need for such a protocol has recently become apparent in the context of split mode ESNI. Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. The IETF Secretariat --00000000000023b6ba058c651ab6 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hi TLS,

This is a proposal f= or a very simple new protocol whose main purpose is to enable ESNI "sp= lit mode".=C2=A0 Ultimately, I hope that this protocol can also enable= more end-to-end TLS, by reducing the need for load-balancers to terminate = TLS.

Please discuss.

Than= ks,
Ben Schwartz

---------- Forwarded message ---------

A new version of I-D, draft-schwartz-tls-lb-00.txt
has been successfully submitted by Benjamin M. Schwartz and posted to the IETF repository.

Name:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0draft-schwartz-tls-lb
Revision:=C2=A0 =C2=A0 =C2=A0 =C2=A000
Title:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 TLS Metadata for Load Balancers Document date:=C2=A0 2019-06-28
Group:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 Individual Submission
Pages:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 8
URL:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 https://www.ietf.org/internet-drafts/draft-schwartz-tls-lb-00.t= xt
Status:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0http= s://datatracker.ietf.org/doc/draft-schwartz-tls-lb/
Htmlized:=C2=A0 =C2=A0 =C2=A0 =C2=A0https://tool= s.ietf.org/html/draft-schwartz-tls-lb-00
Htmlized:=C2=A0 =C2=A0 =C2=A0 =C2=A0https= ://datatracker.ietf.org/doc/html/draft-schwartz-tls-lb


Abstract:
=C2=A0 =C2=A0A load balancer that does not terminate TLS may wish to provid= e some
=C2=A0 =C2=A0information to the backend server, in addition to forwarding T= LS
=C2=A0 =C2=A0data.=C2=A0 This draft proposes a protocol between load balanc= ers and
=C2=A0 =C2=A0backends that enables secure, efficient delivery of TLS with =C2=A0 =C2=A0additional information.=C2=A0 The need for such a protocol has= recently
=C2=A0 =C2=A0become apparent in the context of split mode ESNI.




Please note that it may take a couple of minutes from the time of submissio= n
until the htmlized version and diff are available at tools.ietf.org.

The IETF Secretariat

--00000000000023b6ba058c651ab6-- --0000000000002a5fb8058c651ab6 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIIS5wYJKoZIhvcNAQcCoIIS2DCCEtQCAQExDzANBglghkgBZQMEAgEFADALBgkqhkiG9w0BBwGg ghBNMIIEXDCCA0SgAwIBAgIOSBtqDm4P/739RPqw/wcwDQYJKoZIhvcNAQELBQAwZDELMAkGA1UE BhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExOjA4BgNVBAMTMUdsb2JhbFNpZ24gUGVy c29uYWxTaWduIFBhcnRuZXJzIENBIC0gU0hBMjU2IC0gRzIwHhcNMTYwNjE1MDAwMDAwWhcNMjEw NjE1MDAwMDAwWjBMMQswCQYDVQQGEwJCRTEZMBcGA1UEChMQR2xvYmFsU2lnbiBudi1zYTEiMCAG A1UEAxMZR2xvYmFsU2lnbiBIViBTL01JTUUgQ0EgMTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC AQoCggEBALR23lKtjlZW/17kthzYcMHHKFgywfc4vLIjfq42NmMWbXkNUabIgS8KX4PnIFsTlD6F GO2fqnsTygvYPFBSMX4OCFtJXoikP2CQlEvO7WooyE94tqmqD+w0YtyP2IB5j4KvOIeNv1Gbnnes BIUWLFxs1ERvYDhmk+OrvW7Vd8ZfpRJj71Rb+QQsUpkyTySaqALXnyztTDp1L5d1bABJN/bJbEU3 Hf5FLrANmognIu+Npty6GrA6p3yKELzTsilOFmYNWg7L838NS2JbFOndl+ce89gM36CW7vyhszi6 6LqqzJL8MsmkP53GGhf11YMP9EkmawYouMDP/PwQYhIiUO0CAwEAAaOCASIwggEeMA4GA1UdDwEB /wQEAwIBBjAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwQwEgYDVR0TAQH/BAgwBgEB/wIB ADAdBgNVHQ4EFgQUyzgSsMeZwHiSjLMhleb0JmLA4D8wHwYDVR0jBBgwFoAUJiSSix/TRK+xsBtt r+500ox4AAMwSwYDVR0fBEQwQjBAoD6gPIY6aHR0cDovL2NybC5nbG9iYWxzaWduLmNvbS9ncy9n c3BlcnNvbmFsc2lnbnB0bnJzc2hhMmcyLmNybDBMBgNVHSAERTBDMEEGCSsGAQQBoDIBKDA0MDIG CCsGAQUFBwIBFiZodHRwczovL3d3dy5nbG9iYWxzaWduLmNvbS9yZXBvc2l0b3J5LzANBgkqhkiG 9w0BAQsFAAOCAQEACskdySGYIOi63wgeTmljjA5BHHN9uLuAMHotXgbYeGVrz7+DkFNgWRQ/dNse Qa4e+FeHWq2fu73SamhAQyLigNKZF7ZzHPUkSpSTjQqVzbyDaFHtRBAwuACuymaOWOWPePZXOH9x t4HPwRQuur57RKiEm1F6/YJVQ5UTkzAyPoeND/y1GzXS4kjhVuoOQX3GfXDZdwoN8jMYBZTO0H5h isymlIl6aot0E5KIKqosW6mhupdkS1ZZPp4WXR4frybSkLejjmkTYCTUmh9DuvKEQ1Ge7siwsWgA NS1Ln+uvIuObpbNaeAyMZY0U5R/OyIDaq+m9KXPYvrCZ0TCLbcKuRzCCBB4wggMGoAMCAQICCwQA AAAAATGJxkCyMA0GCSqGSIb3DQEBCwUAMEwxIDAeBgNVBAsTF0dsb2JhbFNpZ24gUm9vdCBDQSAt IFIzMRMwEQYDVQQKEwpHbG9iYWxTaWduMRMwEQYDVQQDEwpHbG9iYWxTaWduMB4XDTExMDgwMjEw MDAwMFoXDTI5MDMyOTEwMDAwMFowZDELMAkGA1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24g bnYtc2ExOjA4BgNVBAMTMUdsb2JhbFNpZ24gUGVyc29uYWxTaWduIFBhcnRuZXJzIENBIC0gU0hB MjU2IC0gRzIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCg/hRKosYAGP+P7mIdq5NB Kr3J0tg+8lPATlgp+F6W9CeIvnXRGUvdniO+BQnKxnX6RsC3AnE0hUUKRaM9/RDDWldYw35K+sge C8fWXvIbcYLXxWkXz+Hbxh0GXG61Evqux6i2sKeKvMr4s9BaN09cqJ/wF6KuP9jSyWcyY+IgL6u2 52my5UzYhnbf7D7IcC372bfhwM92n6r5hJx3r++rQEMHXlp/G9J3fftgsD1bzS7J/uHMFpr4MXua eoiMLV5gdmo0sQg23j4pihyFlAkkHHn4usPJ3EePw7ewQT6BUTFyvmEB+KDoi7T4RCAZDstgfpzD rR/TNwrK8/FXoqnFAgMBAAGjgegwgeUwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8C AQEwHQYDVR0OBBYEFCYkkosf00SvsbAbba/udNKMeAADMEcGA1UdIARAMD4wPAYEVR0gADA0MDIG CCsGAQUFBwIBFiZodHRwczovL3d3dy5nbG9iYWxzaWduLmNvbS9yZXBvc2l0b3J5LzA2BgNVHR8E LzAtMCugKaAnhiVodHRwOi8vY3JsLmdsb2JhbHNpZ24ubmV0L3Jvb3QtcjMuY3JsMB8GA1UdIwQY MBaAFI/wS3+oLkUkrk1Q+mOai97i3Ru8MA0GCSqGSIb3DQEBCwUAA4IBAQACAFVjHihZCV/IqJYt 7Nig/xek+9g0dmv1oQNGYI1WWeqHcMAV1h7cheKNr4EOANNvJWtAkoQz+076Sqnq0Puxwymj0/+e oQJ8GRODG9pxlSn3kysh7f+kotX7pYX5moUa0xq3TCjjYsF3G17E27qvn8SJwDsgEImnhXVT5vb7 qBYKadFizPzKPmwsJQDPKX58XmPxMcZ1tG77xCQEXrtABhYC3NBhu8+c5UoinLpBQC1iBnNpNwXT Lmd4nQdf9HCijG1e8myt78VP+QSwsaDT7LVcLT2oDPVggjhVcwljw3ePDwfGP9kNrR+lc8XrfClk WbrdhC2o4Ui28dtIVHd3MIIDXzCCAkegAwIBAgILBAAAAAABIVhTCKIwDQYJKoZIhvcNAQELBQAw TDEgMB4GA1UECxMXR2xvYmFsU2lnbiBSb290IENBIC0gUjMxEzARBgNVBAoTCkdsb2JhbFNpZ24x EzARBgNVBAMTCkdsb2JhbFNpZ24wHhcNMDkwMzE4MTAwMDAwWhcNMjkwMzE4MTAwMDAwWjBMMSAw HgYDVQQLExdHbG9iYWxTaWduIFJvb3QgQ0EgLSBSMzETMBEGA1UEChMKR2xvYmFsU2lnbjETMBEG A1UEAxMKR2xvYmFsU2lnbjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMwldpB5Bngi FvXAg7aEyiie/QV2EcWtiHL8RgJDx7KKnQRfJMsuS+FggkbhUqsMgUdwbN1k0ev1LKMPgj0MK66X 17YUhhB5uzsTgHeMCOFJ0mpiLx9e+pZo34knlTifBtc+ycsmWQ1z3rDI6SYOgxXG71uL0gRgykmm KPZpO/bLyCiR5Z2KYVc3rHQU3HTgOu5yLy6c+9C7v/U9AOEGM+iCK65TpjoWc4zdQQ4gOsC0p6Hp sk+QLjJg6VfLuQSSaGjlOCZgdbKfd/+RFO+uIEn8rUAVSNECMWEZXriX7613t2Saer9fwRPvm2L7 DWzgVGkWqQPabumDk3F2xmmFghcCAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQF MAMBAf8wHQYDVR0OBBYEFI/wS3+oLkUkrk1Q+mOai97i3Ru8MA0GCSqGSIb3DQEBCwUAA4IBAQBL QNvAUKr+yAzv95ZURUm7lgAJQayzE4aGKAczymvmdLm6AC2upArT9fHxD4q/c2dKg8dEe3jgr25s bwMpjjM5RcOO5LlXbKr8EpbsU8Yt5CRsuZRj+9xTaGdWPoO4zzUhw8lo/s7awlOqzJCK6fBdRoyV 3XpYKBovHd7NADdBj+1EbddTKJd+82cEHhXXipa0095MJ6RMG3NzdvQXmcIfeg7jLQitChws/zyr VQ4PkX4268NXSb7hLi18YIvDQVETI53O9zJrlAGomecsMx86OyXShkDOOyyGeMlhLxS67ttVb9+E 7gUJTb0o2HLO02JQZR7rkpeDMdmztcpHWD9fMIIEZDCCA0ygAwIBAgIMB/CJK1MgpV83jiIZMA0G CSqGSIb3DQEBCwUAMEwxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9iYWxTaWduIG52LXNhMSIw IAYDVQQDExlHbG9iYWxTaWduIEhWIFMvTUlNRSBDQSAxMB4XDTE5MDMxMzA4MjIxOVoXDTE5MDkw OTA4MjIxOVowIjEgMB4GCSqGSIb3DQEJAQwRYmVtYXNjQGdvb2dsZS5jb20wggEiMA0GCSqGSIb3 DQEBAQUAA4IBDwAwggEKAoIBAQCsphkGEsCh0fF4+6Wsi1u40JxI6W6Izew+dLGK4b93LCRAuJ8y g9wSnwGAtk9/23VmtKwBrMaJD5j9SVZpscvLAjrWwADl/THU22uTW0MsUE2fPOPv2s4hE+vMgRmK P2E+xpI6n0gFvn8qrUHO1dm6PJaP5SWa+zdB/Ja1LgMJTpevQqjK4LKjWmHFPR6CplS4RImjGk7U 0I6invTyQnL5p583t5PI7FcM5UyjAqxGEETdAuc7N4IqjNETvPwL0wLIzxPDA5PMqcWPSzg7sBAB LVUQRYNIAJPlVpUdg1IeAjil5BaaWBjEeCLBSGDFX3WaWfMNzQvRZr4i6oJxzV+1AgMBAAGjggFu MIIBajAcBgNVHREEFTATgRFiZW1hc2NAZ29vZ2xlLmNvbTBQBggrBgEFBQcBAQREMEIwQAYIKwYB BQUHMAKGNGh0dHA6Ly9zZWN1cmUuZ2xvYmFsc2lnbi5jb20vY2FjZXJ0L2dzaHZzbWltZWNhMS5j cnQwHQYDVR0OBBYEFFSy8ovdLNSQc8aqxOgKS7sBOm/UMB8GA1UdIwQYMBaAFMs4ErDHmcB4koyz IZXm9CZiwOA/MEwGA1UdIARFMEMwQQYJKwYBBAGgMgEoMDQwMgYIKwYBBQUHAgEWJmh0dHBzOi8v d3d3Lmdsb2JhbHNpZ24uY29tL3JlcG9zaXRvcnkvMDsGA1UdHwQ0MDIwMKAuoCyGKmh0dHA6Ly9j cmwuZ2xvYmFsc2lnbi5jb20vZ3NodnNtaW1lY2ExLmNybDAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0l BBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMEMA0GCSqGSIb3DQEBCwUAA4IBAQCbQ++Znz6xh85ZlZEN Y/vAF0vn111O0c2houe4LlLQkoQ1QS4fH5EYcBx/393FTq5n08ezWYVtmeQ6W15e34CqjYNop1Vh mihZ+3J6+LL/6YNi91cp5yMFgxOP9aI/Y8IaIWZJAY2e8yHbYSq0z8kka0H6S4VvFjwtRogkWW95 0SStEwo/8viJ02BwpmVj4YIA6Fva1ZbeN2TnUMCAHJAlKWOGlpHxpcdcWckED0XbSY9w6bllMw1T tsbiUwQxDeO++Y8NfS8rieZgfv3RlobKihE8xbIVGRHIq1gup4nXv6XDwHDYyGhafIfUD4Ix00Wk gnODGb+jPwoQlDX0X64qMYICXjCCAloCAQEwXDBMMQswCQYDVQQGEwJCRTEZMBcGA1UEChMQR2xv YmFsU2lnbiBudi1zYTEiMCAGA1UEAxMZR2xvYmFsU2lnbiBIViBTL01JTUUgQ0EgMQIMB/CJK1Mg pV83jiIZMA0GCWCGSAFlAwQCAQUAoIHUMC8GCSqGSIb3DQEJBDEiBCCvbA+Hkmdr9YeswghtqGGw a5Pgl8QG4cVqao+aA3pOTjAYBgkqhkiG9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEP Fw0xOTA2MjgxNjUyMjJaMGkGCSqGSIb3DQEJDzFcMFowCwYJYIZIAWUDBAEqMAsGCWCGSAFlAwQB FjALBglghkgBZQMEAQIwCgYIKoZIhvcNAwcwCwYJKoZIhvcNAQEKMAsGCSqGSIb3DQEBBzALBglg hkgBZQMEAgEwDQYJKoZIhvcNAQEBBQAEggEANUQcvMzNMEV2LVBQGF9JvHHRB7afX6FoWv+ThBne r36OIXoh3WHrUJb9Xt+C38TZe8t2Bx5pQW1dpsh3gjUQ10X1onmT9kU1D+WITHrdsOiTZxOMrLwT vCqYWg5tHY5IQCdJxmgUBY53lpHzUlGV3wjxbyl1KpoJObyKfpnjwIm5GiUnrTYlra3Uxm/GBWgr HJtO/m4IzTzzDC034Xftaaf9APrtaoB9KwRPtW8Z8GsWquWRNYfYUgx+UKqqvSpTogn4tzFDBJiP KgPMCEmRQwsQv+ujiZzh+6vlGApj1Mmoq/42A4vBNE+dUFx3Kcy3kMk+oHcznTyOIJs+8JZKqA== --0000000000002a5fb8058c651ab6-- From nobody Fri Jun 28 10:34:31 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D575E120615 for ; Fri, 28 Jun 2019 10:34:28 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.299 X-Spam-Level: X-Spam-Status: No, score=-4.299 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id s90-kS-DZA5U for ; Fri, 28 Jun 2019 10:34:26 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id F06201200B8 for ; Fri, 28 Jun 2019 10:34:25 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id BFB39BE2F; Fri, 28 Jun 2019 18:34:21 +0100 (IST) X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Hbf1Htpdocvc; Fri, 28 Jun 2019 18:34:12 +0100 (IST) Received: from [10.244.2.138] (95-45-153-252-dynamic.agg2.phb.bdt-fng.eircom.net [95.45.153.252]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id 55485BE20; Fri, 28 Jun 2019 18:34:12 +0100 (IST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1561743252; bh=eO+zWJJyIzuvei/QUajDkfKAGQS6oHTOe6IOvBhBVqU=; h=To:References:From:Subject:Date:In-Reply-To:From; b=E1d0Jf4Sdjbl/ZqYtUAsu9vKd7ufcseSQ77KeCDnEgq0Tg5IikaJ2wnB9qP28ATY1 eGo+vwDMuJx/rlvR83yp/bF1hIlyeKDUtiBZPfiIgtfK3aKZ0nMyncroTJXJZd6stb WWzbnfImq85QADQCYGqOrj0C3WhCj4acB72vBJW4= To: Ben Schwartz , "" References: <156173339678.20700.10472293883370612968.idtracker@ietfa.amsl.com> From: Stephen Farrell Openpgp: id=5BB5A6EA5765D2C5863CAE275AB2FAF17B172BEA; url= Autocrypt: addr=stephen.farrell@cs.tcd.ie; prefer-encrypt=mutual; keydata= mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nemCP5PMvmh 5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kTq0IqYzsEv5HI58S+ QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtEgvw4fVhVWJuyy3w//0F2tzKr EMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy+pAh4EKzS1FE7BOZp9daMu9MUQmDqtZU bUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqO Vz+7L+WiVfxLbeVqBwV+4uL9to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJg b097ZaNyuY1ETghVB5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k 4LyM2lp5FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9tlyWxn5Xi HzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQABtDJTdGVwaGVuIEZh cnJlbGwgKDIwMTcpIDxzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPokCQAQTAQgAKgIbAwUJ CZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAUCWj6jdwIZAQAKCRBasvrxexcr6o7QD/9m x9DPJetmW794RXmNTrbTJ44zc/tJbcLdRBh0KBn9OW/EaAqjDmgNJeCMyJTKr1ywaps8HGUN hLEVkc14NUpgi4/Zkrbi3DmTp25OHj6wXBS5qVMyVynTMEIjOfeFFyxG+48od+Xn7qg6LT7G rHeNf+z/r0v9+8eZ1Ip63kshQDGhhpmRMKu4Ws9ZvTW2ACXkkTFaSGYJj3yIP4R6IgwBYGMz DXFX6nS4LA1s3pcPNxOgrvCyb60AiJZTLcOk/rRrpZtXB1XQc23ZZmrlTkl2HaThL6w3YKdi Ti1NbuMeOxZqtXcUshII45sANm4HuWNTiRh93Bn5bN6ddjgsaXEZBKUBuUaPBl7gQiQJcAlS 3MmGgVS4ZoX8+VaPGpXdQVFyBMRFlOKOC5XJESt7wY0RE2C8PFm+5eywSO/P1fkl9whkMgml 3OEuIQiP2ehRt/HVLMHkoM9CPQ7t6UwdrXrvX+vBZykav8x9U9M6KTgfsXytxUl6Vx5lPMLi 2/Jrsz6Mzh/IVZa3xjhq1OLFSI/tT2ji4FkJDQbO+yYUDhcuqfakDmtWLMxecZsY6O58A/95 8Qni6Xeq+Nh7zJ7wNcQOMoDGj+24di2TX1cKLzdDMWFaWzlNP5dB5VMwS9Wqj1Z6TzKjGjru q8soqohwb2CK9B3wzFg0Bs1iBI+2RuFnxLkCDQRaPVAyARAA+g3R0HzGr/Dl34Y07XqGqzq5 SU0nXIu9u8Ynsxj7gR5qb3HgUWYEWrHW2jHOByXnvkffucf5yzwrsvw8Q8iI8CFHiTYHPpey 4yPVn6R0w/FOMcY70eTIu/k6EEFDlDbs09DtKcrsT9bmN0XoRxITlXwWTufYqUnmS+YkAuk+ TLCtUin7OdaS2uU6Ata3PLQSeM2ZsUQMmYmHPwB9rmf+q2I005AJ9Q1SPQ2KNg/8xOGxo13S VuaSqYRQdpV93RuCOzg4vuXtR+gP0KQrus/P2ZCEPvU9cXF/2MIhXgOz207lv3iE2zGyNXld /n8spvWk+0bH5Zqd9Wcba/rGcBhmX9NKKDARZqjkv/zVEP1X97w1HsNYeUFNcg2lk9zQKb4v l1jx/Uz8ukzH2QNhU4R39dbF/4AwWuSVkGW6bTxHJqGs6YimbfdQqxTzmqFwz3JP0OtXX5q/ 6D4pHwcmJwEiDNzsBLl6skPSQ0Xyq3pua/qAP8MVm+YxCxJQITqZ8qjDLzoe7s9X6FLLC/DA L9kxl5saVSfDbuI3usH/emdtn0NA9/M7nfgih92zD92sl1yQXHT6BDa8xW1j+RU4P+E0wyd7 zgB2UeYgrp2IIcfG+xX2uFG5MJQ/nYfBoiALb0+dQHNHDtFnNGY3Oe8z1M9c5aDG3/s29QbJ +w7hEKKo9YMAEQEAAYkCJQQYAQgADwUCWj1QMgIbDAUJCZQmAAAKCRBasvrxexcr6qwvD/9b Rek3kfN8Q+jGrKl8qwY8HC5s4mhdDJZI/JP2FImf5J2+d5/e8UJ4fcsT79E0/FqX3Z9wZr6h sofPqLh1/YzDsYkZDHTYSGrlWGP/I5kXwUmFnBZHzM3WGrL3S7ZmCYMdudhykxXXjq7M6Do1 oxM8JofrXGtwBTLv5wfvvygJouVCVe87Ge7mCeY5vey1eUi4zSSF1zPpR6gg64w2g4TXM5qt SwkZVOv1g475LsGlYWRuJV8TA67yp1zJI7HkNqCo8KyHX0DPOh9c+Sd9ZX4aqKfqH9HIpnCL AYEgj7vofeix7gM3kQQmwynqq32bQGQBrKJEYp2vfeO30VsVx4dzuuiC5lyjUccVmw5D72J0 FlGrfEm0kw6D1qwyBg0SAMqamKN6XDdjhNAtXIaoA2UMZK/vZGGUKbqTgDdk0fnzOyb2zvXK CiPFKqIPAqKaDHg0JHdGI3KpQdRNLLzgx083EqEc6IAwWA6jSz+6lZDV6XDgF0lYqAYIkg3+ 6OUXUv6plMlwSHquiOc/MQXHfgUP5//Ra5JuiuyCj954FD+MBKIj8eWROfnzyEnBplVHGSDI ZLzL3pvV14dcsoajdeIH45i8DxnVm64BvEFHtLNlnliMrLOrk4shfmWyUqNlzilXN2BTFVFH 4MrnagFdcFnWYp1JPh96ZKjiqBwMv/H0kw== Message-ID: Date: Fri, 28 Jun 2019 18:34:11 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.7.1 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="5ojzgAU0AxESLaQoMOYnHoj5skqm5ArRg" Archived-At: Subject: Re: [TLS] Fwd: New Version Notification for draft-schwartz-tls-lb-00.txt X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 28 Jun 2019 17:34:29 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --5ojzgAU0AxESLaQoMOYnHoj5skqm5ArRg Content-Type: multipart/mixed; boundary="SsEJuMBr3IpUKGLkApu5PxSJFbcZWi17L"; protected-headers="v1" From: Stephen Farrell To: Ben Schwartz , "" Message-ID: Subject: Re: [TLS] Fwd: New Version Notification for draft-schwartz-tls-lb-00.txt References: <156173339678.20700.10472293883370612968.idtracker@ietfa.amsl.com> In-Reply-To: --SsEJuMBr3IpUKGLkApu5PxSJFbcZWi17L Content-Type: multipart/mixed; boundary="------------0C49B8BB78791C32EE478CA0" Content-Language: en-GB This is a multi-part message in MIME format. --------------0C49B8BB78791C32EE478CA0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hi Ben, Thanks for posting that - good to see a start on plugging that gap. On 28/06/2019 17:52, Ben Schwartz wrote: > Hi TLS, >=20 > This is a proposal for a very simple new protocol whose main purpose is= to > enable ESNI "split mode". Ultimately, I hope that this protocol can al= so > enable more end-to-end TLS, by reducing the need for load-balancers to > terminate TLS. I guess an alternative would be to wrap this metadata and the TLS session in another possibly long-lived TLS session between the LB and backend. That'd have the benefit of not requiring a PSK, making correlation of the CH etc from TLS client to LB with the LB to backend non-trivial(*), but I guess at the cost of more CPU and per-packet overhead. The fact that a network observer can so easily correlate the inbound TLS packets to the LB with those outbound seems like a fairly major downside of this approach to me. The PSK would also make it hard to offer ESNI fronting to random backends without pre-arrangement between the LB and backend, should that be something someone wanted to do. I think that would allow less centralised deployment of ESNI, which I think is a pretty desirable option to preserve. Also: a diagram would really help make the draft easier to grok:-) Cheers, S. (*) When I say non-trivial here I don't mean "very hard":-) >=20 > Please discuss. >=20 > Thanks, > Ben Schwartz >=20 > ---------- Forwarded message --------- >=20 > A new version of I-D, draft-schwartz-tls-lb-00.txt > has been successfully submitted by Benjamin M. Schwartz and posted to t= he > IETF repository. >=20 > Name: draft-schwartz-tls-lb > Revision: 00 > Title: TLS Metadata for Load Balancers > Document date: 2019-06-28 > Group: Individual Submission > Pages: 8 > URL: > https://www.ietf.org/internet-drafts/draft-schwartz-tls-lb-00.txt > Status: https://datatracker.ietf.org/doc/draft-schwartz-tls-lb/= > Htmlized: https://tools.ietf.org/html/draft-schwartz-tls-lb-00 > Htmlized: https://datatracker.ietf.org/doc/html/draft-schwartz-tl= s-lb >=20 >=20 > Abstract: > A load balancer that does not terminate TLS may wish to provide some= > information to the backend server, in addition to forwarding TLS > data. This draft proposes a protocol between load balancers and > backends that enables secure, efficient delivery of TLS with > additional information. The need for such a protocol has recently > become apparent in the context of split mode ESNI. >=20 >=20 >=20 >=20 > Please note that it may take a couple of minutes from the time of submi= ssion > until the htmlized version and diff are available at tools.ietf.org. >=20 > The IETF Secretariat >=20 >=20 > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls >=20 --------------0C49B8BB78791C32EE478CA0 Content-Type: application/pgp-keys; name="0x5AB2FAF17B172BEA.asc" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="0x5AB2FAF17B172BEA.asc" -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nem CP5PMvmh5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kT q0IqYzsEv5HI58S+QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtE gvw4fVhVWJuyy3w//0F2tzKrEMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy +pAh4EKzS1FE7BOZp9daMu9MUQmDqtZUbUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5 iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqOVz+7L+WiVfxLbeVqBwV+4uL9 to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJgb097ZaNyuY1ETghV B5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k4LyM2lp5 FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9t lyWxn5XiHzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQAB tCFTdGVwaGVuIEZhcnJlbGwgPHN0ZXBoZW5AamVsbC5pZT6JAj0EEwEIACcFAlo9 UYwCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQWrL68XsXK+qG CxAApYHWYgGOIL3G6/OpkejdAkQoCVQAK8LJUSf6vzwost4iVfxIKcKW/3RqKNKk rRl8beJ7j1CWXAz9+VXAOsE9+zNxXIDgGA7HlvJnhffl+qwibVgiHgUcJFhCSbBr sjC+1uULaTU8zYEyET//GOGPLF+X+degkE/sesh4zcEAjF7fGPnlncdCCH3tvPZZ sdTcjwOCRVonKsDgQzBTCMz/RPBfEFX44HZx4g1UQAcCA4xlucY8QkJEyCrSNGpG nvGK8DcGSmnstl1/a9fnlhpdFxieX3oY2phJ1WKkYTn6Advrek3UP71CKxpgtPmk d3iUUz/VZa0Cv6YxQXskspRDVEvdCMYSQBtJPQ4y2+5UxVR9GIQXenwYp9AP2niv Voh+ITsDWWeWnnvYMq07rSDjq0nGdj41MJkNX+Yb2PXVyXItcj5ybE3T2+y3pSBG FEZYJGuaL4NwtBJFMOdOtBmUOPbetS2971EL3Izxb7ibOZWDwexv+8R6SWYfP1wV N3p46RyBQuXqJV8ccE11m6vtZTGSYgnLUUFZMRQYH+0hwuYe0T3AA18xDdSYsa8v ovCCd3l5S4UNzIM2PMChqGrEzKapUpZg7+8ACcxRU3b9Ihd7WYjJ+pQPCoWYKozv tEvenbNpE/govO/ED3B14e+R2yevRPjRrsN7PJzSf15fQLuJARwEEAEIAAYFAlo9 UqAACgkQLzyHNoBfjaLrSwf+MIHbFRQ4O5cmLYR5sIByWelN3SuRN/gW8rpKo9Ok Cz6An8uV/iCXy5tNMLzzi0BFl8f22DwBcC5qy9qnlIAdogWam1qWoTAoAD8veEqm uKhYrqJsCcAyNrKYmK0hP3rpHxx1LySDmKYXmw/8qtBXKHTouMm+5tSsznhykRMT AAr2p7PSaHgo+hIVaW/rKSspHjDhhZS+G9mtOZad1IH29M6G1Q1NCO0Ywe8krKLQ IAQlFxtgvOqpPOZNzeKBa/+KbE8TGgMWrkOhC8OeEM5PVzdDhlhD9kPzB/pCKDF5 DofJ/ZRqnDpbKPQ0bsW38AOig3kOc0A27awiBEw3urqR1YkCMwQQAQgAHRYhBH4X CgRchM9GDit5oBDvedn9g1MSBQJbtyScAAoJEBDvedn9g1MSI/oP/0A9J9nrnBMq Zpm857lfYWw+rshLK+tyeP4OQeOqnDFvs9jePpcyJLG3DF2r6VbVKPQq+AE6Uf5h cJBDEN6BjEhRPSbLcqG3A1cz/nNwm8rPmNp+oKhmaBBQGxwciMLmzgynsDydnjPp MyEs04zvsbsl4vrp2095o105l8KcrrxQrioFjbwveGwHQK9bxJKhx9D+gIk+MouB ur45UDKTZkMZrr9FGrtkyXCGAxvKdcNC5Oa8z9sj1rcUJfG/OpVAMWhArdlZbFUQ yoX6pU2Zb1CR2qpWAVerGSfBhmfCyStjARqaKxlftjO+Bj3Jj73Cr5eqej3qB5+V 4BCsPjr4RLvVbYUCPsRdxWc+nBLlfVYkRURu21g1hFm5KFPjgUkyo1s4vjUOY8Dy I+xLGF7f/IhUBG6l+Vswhpwu7ydalZkeFiPx5xna5NfbEYxvsIf71DvipGvIOaHv X4egWoFgm8n/9c3rcMxJtpwHPSsUt5dgLsyu6VE0IbvOAc3dN7CWJ355DVFJq9Zg 2YVf0izSpyyzJeGsgkfjW6xpmdvZxuT2UcN4BTcm6vYqueASGrb3lfhzC5gpeVsc /MoSjTS65vNWbpzONZWMZuLEFraxWJzC0JrDK3NCd0VN3kstqGkVbUIiYOnUm8Vu 4zoVMLlGWzHLIGoPRG2nRezn1YyNfyb5iQGcBBABCgAGBQJbxcflAAoJEGo7ETk8 pK1gE7QL/ApC5P68W5DrI1787WJVZv1u4t/g39vTr7Xer3UMTVQg10vpa7pmqOGh jIDzDMg3Pe3K3M7fVzfAlUA1qw6ne4RCueVoRKpubeF4AlYbMr0K6hNCPjt5uAxm bBVuejKTc6pru5rv5gKL0nDbr+Snft5xt7juBLSSimw0/41sZnkjCxo9rF/RA/v6 +uWyK171RKmsEYu8fFtw1eqUNt/Xj792TUixE3pxXheNtQtZGk/9P3W83ChhG4Fh 5EQsn0pIh9wZIAbMRLpgRKyW87fWHZC8/YH8h7afarvn9Thl5pFUldCe22mNJj6K LChn2aEHQd+PdY1GBpZEcmNEUPuovwzatM0h64hCzTm41eDqRfihZVBT7TbfXQnv 8rywa42Mk756RGzzEZcQEhwQXZcMQUfxIQQ2VyJo0zG36VdZTQF7TF/4Lz7/3cJ5 6jOIm+dwPXtu+C2wAQuD4USOLt4JWPYpqzDfHYJIND/497P9Z9SuQeahr2ez3DRB g3qsHEjBV7QyU3RlcGhlbiBGYXJyZWxsICgyMDE3KSA8c3RlcGhlbi5mYXJyZWxs QGNzLnRjZC5pZT6JAkAEEwEIACoCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwEC HgECF4AFAlo+o3cCGQEACgkQWrL68XsXK+qO0A//ZsfQzyXrZlu/eEV5jU620yeO M3P7SW3C3UQYdCgZ/TlvxGgKow5oDSXgjMiUyq9csGqbPBxlDYSxFZHNeDVKYIuP 2ZK24tw5k6duTh4+sFwUualTMlcp0zBCIzn3hRcsRvuPKHfl5+6oOi0+xqx3jX/s /69L/fvHmdSKet5LIUAxoYaZkTCruFrPWb01tgAl5JExWkhmCY98iD+EeiIMAWBj Mw1xV+p0uCwNbN6XDzcToK7wsm+tAIiWUy3DpP60a6WbVwdV0HNt2WZq5U5Jdh2k 4S+sN2CnYk4tTW7jHjsWarV3FLISCOObADZuB7ljU4kYfdwZ+WzenXY4LGlxGQSl AblGjwZe4EIkCXAJUtzJhoFUuGaF/PlWjxqV3UFRcgTERZTijguVyREre8GNERNg vDxZvuXssEjvz9X5JfcIZDIJpdzhLiEIj9noUbfx1SzB5KDPQj0O7elMHa1671/r wWcpGr/MfVPTOik4H7F8rcVJelceZTzC4tvya7M+jM4fyFWWt8Y4atTixUiP7U9o 4uBZCQ0GzvsmFA4XLqn2pA5rVizMXnGbGOjufAP/efEJ4ul3qvjYe8ye8DXEDjKA xo/tuHYtk19XCi83QzFhWls5TT+XQeVTMEvVqo9Wek8yoxo67qvLKKqIcG9givQd 8MxYNAbNYgSPtkbhZ8SJARwEEAEIAAYFAlo9UqAACgkQLzyHNoBfjaLzHAgAlWT6 NXEGtw/r1miKNGcopzvzILQ9oB8rKI9U9EL6tOf/y2V5oYee/GyQDb3ZdoPxxYYc Jf+RyiH1nMoqUIZiZJaf3bJXinDZ5+AdfE++UR2NBvqaNyC6u3r24jo1B/sagKbY tWgsYtRqHLD4IWi37MZrVyjBuF7u14Q07+uhjq6mX2O/tHpCYw/Q82tbeTRPyUf1 WQOAfD1kfBpW9PvAva5Iw9FWeXpCXRzwxnCZhYfGfqtuSw6CPBYLdbikqML6FZ7E DuTBb/8um1wK7Y9bgeIQC+CYjhYB5RXa1tDJRab2Js4luCvSR0w/CgHw26293tlv e2Q6UTrmHxP5U22DlokCPQQTAQgAJwUCWj1QMgIbAwUJCZQmAAULCQgHAgYVCAkK CwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6tJpD/4rrILH+meP07vrx8wW5eYuqCiP GYnh/CXxIF8eLrfbe5d4QRgtq+w6UeQPMyzKRIRiCoBXB2oJLBZHyxBPxZlg33dT MrEGn8QWKx2iNuz9rZMXyOSWFetuO01d/aUPd5BnbLbIyK5of8xCQlXM6KH8bc+9 gQ7edR9mfLTdvBf2FR522hg8BRBM1imKc3vO8v39+qIHHRjuiwxBBCAOhHtHRsZX ripS0uFA07dM46Oi/E8osjx6fQt/lH5z/PN+2adxYSrLSAXfr1oD3RxYNhuWgyGF L64/VCQb1YGjf0Z5MBPnWm9jgUoOY5K9eNSS0L83WeJjlF5+Q/WOgB+rb49Prm2D Feo9+S9f2V53Llz1WIspXJg6f+n9lmHE94MfQj1GAHCzI0FeL19lvM+LhD8jJSCb hrC3+yobyy/AUOs5Z3E+njjX1FF/VCVAs6iOa6i+XG+Y1hh3ir2y1kckJ5auT10M SU8GEZu9ayU4M3o3N9yxOjaoP0NuQ4MMLL/n/u4u94AeZaHPNBXn/hVfVRRmpRXt GKvJtFAEppGEYezB+bLKIm6XlpPkhnwYzleLZ7AMEco2C6QM8QPB3g3JpS3sqRhA 5rEP4lL16BmijmF+CHoPE/zwgKZbKpyVDqvIW5IDgvfIC2X4pbZDRvGIUKaGSB4+ ksZgUUnNyvfQr2p7jokCMwQQAQgAHRYhBH4XCgRchM9GDit5oBDvedn9g1MSBQJb tySbAAoJEBDvedn9g1MSeKkQAJm44jt1kwHgQgeDBKdjdvl0AjE0xVEQxriZ6lP/ l//34YT0auFfzsYIrChSpQXAEtobBAr4Ohw1Us+BZe+H5P8vm6LRuPwozC3SjwfX 4Iec8+9ot6tIVg4sbedDSgb/CCFVjsmIGcQ1P73JLJTBJ6mxYCV/gn3QC6bwDOFo 7kD9FDHCjRN8XfhHQ4Q9cYyt06uF31qG/aumgWYC9geCGgAwiHgwxNYb9GoJ0iZj CROwbYvLTcQgsVUW2bTmsVR13UVKDsdl02sRV7qcVYW6R0a3Ra8KudX+nt25H5DR Gd382KZ5W8pydsy/viTvD9z6v0ulChBYxAedIvGIClrhbxlLEPmIg4ImVOLGqsUg Vm32J95WOjEkk4PEZ12xSDBtwhSJqmJNboWlfmw43KdIbY8zNhffIO3N6O7FsdGx mqyHeLoTpqY+ySVUPpbuyW8ujnI/J//+6hdTZ9dQsEJQlWngKuWOQ5ma58MPSN88 zllsqhZAFQjNxqnkSzL6ZQ+v/jvuRRe16B80AeO55DsmbWsMv/YLLD1mSi7+Khy2 EtMBhgojWwrGMvdLN6X3mnzNJEscYyLxM9tSk+iySP2sLthK0BVgpAzBSdaf/ezI z60P+neHDzteNFf8Mn7lmgYk1amvZoJ29s5+n2HwxyRL5dVMyMdyQmntubbctfqr Z0tIiQGcBBABCgAGBQJbxcflAAoJEGo7ETk8pK1gnCYMAJY4FeIYjlIXGghFWzsB 4fYwK1+iaFpU3fSto5qcrqVtVPjXpwqczqBWeXGyQxiB0kan4OVAXydIeaP8EAuF CA7paP3s9STLJBO3KurkwyRkPW5zo0X7xVqaVToRsX2Ul98KVJoHYQD1KdezEtwl vpNwiiBr42AYR751Vm6JBVAbQXuFpB3c8bUV0OkkRxNFtL8/2PieHar58n5dntGk bPlPkztahsFqktgacIgXHX5vaT+7YeeZ1DWLOYjGO0wNhkOSeroCmxwJUikU7joB p823L7r5KfpqWTPpSCzVstQKZUGmmoE1qCswY/Ud5wvp9SccpIILkRXj0rZRtfnE 5MpL3hjmtNzfDd9qIsJtBJlSB2hZwAsVm1l+EWN9hG3tqyA43niUMy2n6q690of3 berSiQ+kvY/aC9Hx8I+bKzOV9/J2VUTqfaPZa4Uy2rVX5Q2p69n/PMj7mEer0rCL 3j9V16J9c+s0BSkXoKdtYdB0TWVhBgUybd9qtYcwHWvhP7QuU3RlcGhlbiBGYXJy ZWxsIDxzdGVwaGVuQHRvbGVyYW50bmV0d29ya3MuY29tPokCPQQTAQgAJwUCWj1R WgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6jsc EADEcB0WQEZn2AkrzDs1RhL0Lp6cZi0BigofkbcGfdhJyMSs19C0dhvncrAFClVI 6/Udw3yFtDyYtOCf2W3M3A1K6/RfEizCLzTsdFIhni9gOJLlUpXViQtgrlstjk7h qVV3Ooz4BlCqS4cG7rfqf4LQQPpTAuFUEV9I28FBUB2irqC+v4gTysIgpMw0bA1y BU9sX5jE/tRkzqnuzZrkwiobDtRFJ9qp+7O2JtcY4EsVtLAsaodJKc5cF8R4OvB1 n66vxxcgg9Eh4JNWZ47xsaCmAGo1Bcb2jIY35OtgAL7gCGLRSMKTtAaPy1/fEgIq hCljJ9x40Fkn/3r2BX21WC9HFSPFTBz2RluLRzxdgxOrkYK8EiHUPoE5b1AEzZKw 2AbeXfr57f5zYsN3IqfbQLUjMYtUN1wK3Pjb+idD972wyXMWt8uOzlI7b9Ocu+nY m2whBfJv9Pmp3QYTmPz+LB9lH65VNVUSxSXVr5iWXO3qx1HtEiGEqkporMQCTh3T 5Ud3PvMSRBFFKNs9WhJ/Lxz+SV30WLwG6dr5mQqlzAhb4Phc/zekZyXRdS/oDKrB LUucS36O//49JeyRi1QvOfxnfmIqRIAf/k3PoYJmTo5E82//r5Qj3YGlRu78ba0H Arxs+ACD6AnEHHcbswpbtVEKYzlSu0Ar0Dc7vRWM/IyQdIkBHAQQAQgABgUCWj1S oAAKCRAvPIc2gF+NosIsB/9f/29FNla3BJfGIEIDnhrqGD0i9bSa89SqBd++uG06 TQgW5wsqtNcrwn81yZTq6XE6i9VtD4GKfqC0d4KZJr9bnbeD81cI64VOdL8zJWJs 0vj5EIXCobKyX74Kb4uePUyZqwT2Q74I116u/HwA9/FXsPo5isbh4ZqD4t0VHpWk mfq1FPT9a/JPyX46qKqB2Fce/7Qy+SQP1NfkuUlbhUH/JG9aSSYvk3lznNiH41x9 M+FDlL106itXOubrl3oi2fT3fsSedq7uzt+IV0DQEeNaoQAUuwEhdB8IWOMqN2wo DjGVKJftfsSWY9ilZrnDBNDrp0vRqcx33LUMkIw4d7iBiQIzBBABCAAdFiEEfhcK BFyEz0YOK3mgEO952f2DUxIFAlu3JJwACgkQEO952f2DUxJjuw/6ApHSsVTWD4a0 H6FJ23A9Ftpy+aXZ4vYlzkSrfsn2ECrEfK3lXQh/uzwjJUDYZeB1/BQsFZtcYNQO JSSHbQ49BFRLwb1J/wBZG4bbmrkLxnNbKDKQvzxEpclkMW0Dj0J6o7kGrmzIGGrh B+JJN99AcineHRug8ZSFIERRCmigxdhAKU0BFD7P+5HNHltSL3DF1c2fFOf2JrgB KVoE+9RhMZjWNbYetFFLCkjXb5Rpay9zeMm1DxfSTGAnuOwUXW6qq4hnl5+VC/48 ceDZElLLfu7RQUZv44pkSTOWZs+iQoJiHMFHk9wPqyB2Vok1yJ2a2j27WhXrJlPw nZbgJO5RyWDG3p/eVmpl5Uuc2dsfIpR17KnAuWpghK6V+cyFncDoGCl/YG2Mvool sW08FiZh3Ej4dnJjj25TZkeFG74JJDXLvMYpJfSBGnmETv4Dhcm2xPqVMuFuL1qJ lMbVLrMo2GXeo03OzNyvbs+u8WLIaGm5hC7N1CXY8wZs4jo6OJ/expvnc07dEuws 4zT3AiWv3nIouWReRStZy9QkavDocqbyPmilcdPCYk4BsOlzpwwO74hNG7iyl0Kd AlwTxGQ7y0rJou6HYa1TmRhIEr3vKvlW+JfUUrqtjXgsuacTXo4+Ira2JUErL2cY zQMq1j4r1ZyhFnuz93s7Rsx/Nw0+0YuJAZwEEAEKAAYFAlvFx+UACgkQajsROTyk rWCJqwv+NLVPE4sD4sDA2/6Ek7UsRIUkg+S39fhqWsLc4rtw/mDunv8Un61I3K04 fZ2Ry4nF9hZM0a710UvXFbStvrzRJO3EAAcdJR9LTCd19e8UeruQbIee3YT91U4N kC9JMpecfq62/teOAU2e5P3fWYaLs5ZX7zCLwWuBcW2l3SyoljQczM85HhJ3XHm+ FnwQ6D9xRle+lvWTcuC9d1yAyUb8IOospcL2lJTmy8e3r79R24hPlSB4LDe0wEN8 AXbagrcAQZjwyaHyWxjJbTwZ0b43WGdfIqZ1ElOeoffbketPGRmWvx5xUvb2ALFB BdETzV270gs5XDJgJ1SIIKOyDADxwvroTe2jD8C/841eEql5QSow3s/U3zRqk3mt tto8Qw/DN71aeh6dmYSsvd2UjsHw/vofOPRBGxZLEkKTEvMnhmMW9hiKPkPia+Qg evYE020qpKSxLEdWA8nprHwxmGiDNesCfXSC6vm1qfyj5g8HzxSckq9ZaMhKMCo7 vxflUEDuuQINBFo9UDIBEAD6DdHQfMav8OXfhjTteoarOrlJTSdci727xiezGPuB HmpvceBRZgRasdbaMc4HJee+R9+5x/nLPCuy/DxDyIjwIUeJNgc+l7LjI9WfpHTD 8U4xxjvR5Mi7+ToQQUOUNuzT0O0pyuxP1uY3RehHEhOVfBZO59ipSeZL5iQC6T5M sK1SKfs51pLa5ToC1rc8tBJ4zZmxRAyZiYc/AH2uZ/6rYjTTkAn1DVI9DYo2D/zE 4bGjXdJW5pKphFB2lX3dG4I7ODi+5e1H6A/QpCu6z8/ZkIQ+9T1xcX/YwiFeA7Pb TuW/eITbMbI1eV3+fyym9aT7Rsflmp31Zxtr+sZwGGZf00ooMBFmqOS//NUQ/Vf3 vDUew1h5QU1yDaWT3NApvi+XWPH9TPy6TMfZA2FThHf11sX/gDBa5JWQZbptPEcm oazpiKZt91CrFPOaoXDPck/Q61dfmr/oPikfByYnASIM3OwEuXqyQ9JDRfKrem5r +oA/wxWb5jELElAhOpnyqMMvOh7uz1foUssL8MAv2TGXmxpVJ8Nu4je6wf96Z22f Q0D38zud+CKH3bMP3ayXXJBcdPoENrzFbWP5FTg/4TTDJ3vOAHZR5iCunYghx8b7 Ffa4UbkwlD+dh8GiIAtvT51Ac0cO0Wc0Zjc57zPUz1zloMbf+zb1Bsn7DuEQoqj1 gwARAQABiQIlBBgBCAAPBQJaPVAyAhsMBQkJlCYAAAoJEFqy+vF7FyvqrC8P/1tF 6TeR83xD6MasqXyrBjwcLmziaF0Mlkj8k/YUiZ/knb53n97xQnh9yxPv0TT8Wpfd n3BmvqGyh8+ouHX9jMOxiRkMdNhIauVYY/8jmRfBSYWcFkfMzdYasvdLtmYJgx25 2HKTFdeOrszoOjWjEzwmh+tca3AFMu/nB++/KAmi5UJV7zsZ7uYJ5jm97LV5SLjN JIXXM+lHqCDrjDaDhNczmq1LCRlU6/WDjvkuwaVhZG4lXxMDrvKnXMkjseQ2oKjw rIdfQM86H1z5J31lfhqop+of0cimcIsBgSCPu+h96LHuAzeRBCbDKeqrfZtAZAGs okRina9947fRWxXHh3O66ILmXKNRxxWbDkPvYnQWUat8SbSTDoPWrDIGDRIAypqY o3pcN2OE0C1chqgDZQxkr+9kYZQpupOAN2TR+fM7JvbO9coKI8Uqog8CopoMeDQk d0YjcqlB1E0svODHTzcSoRzogDBYDqNLP7qVkNXpcOAXSVioBgiSDf7o5RdS/qmU yXBIeq6I5z8xBcd+BQ/n/9Frkm6K7IKP3ngUP4wEoiPx5ZE5+fPIScGmVUcZIMhk vMvem9XXh1yyhqN14gfjmLwPGdWbrgG8QUe0s2WeWIyss6uTiyF+ZbJSo2XOKVc3 YFMVUUfgyudqAV1wWdZinUk+H3pkqOKoHAy/8fST =3DYzQY -----END PGP PUBLIC KEY BLOCK----- --------------0C49B8BB78791C32EE478CA0-- --SsEJuMBr3IpUKGLkApu5PxSJFbcZWi17L-- --5ojzgAU0AxESLaQoMOYnHoj5skqm5ArRg Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEW7Wm6ldl0sWGPK4nWrL68XsXK+oFAl0WT5MACgkQWrL68XsX K+o12g/5AVw1Vaq4sL/TpTq0JAHWdCy/eBL1BNT++6j2Nyy0xzLPbxtk8jQfMOas MS0FmLUMqekc1HUMtr32RrNM8Z+xnxq6XzikomX12gxvOGUbjdgSXELoriC6i3VG LKldSrGKtKwQEi/2EYTKRuskNZ8WRP6WUqz0X5O+65Mmm9ML2L2MUlTQW6hd4PwN 7fOarEKg7jPAUObGQGoZnHkxf1nQGLPywcAG68x+0zGWmKWogtEBA4A+uaxQVztM gYYDWrz7eoeOKrMUt6+kI0eCQUUCYzvrqwtRXt/UgOcw3cpmuI3f/XMxzTlqzAH8 2TfEUocEthCE8aZlkwcMfJb/SphFHDT7GVYmxPC2z8OIkb8GotxGU4SkTkW2y/MW aPXXiRXs3cDG9Ds/6i690pfos/i6Q+Gl94SrKM1ZQiU52uRZ/I/DW2qAcxcO3upB D7/IGUMz3biPHQkFjrJMT6UrIslyfeMMXTXyeNUmOGPZYrLi1Bk9JUgHYfW7Q9kj +WDY7nkeROYe+/DrBl6fgtXYWZea5kFtdPlTj5Gl0Z5J6+3CIsw5rHoFKOfcuuUO 403ujbThrDgoYMIDVS+9NIl0EOLX+yHPbdhtk6twHhC5AIBaOoBLXv77luG0j/07 WHy3BF22Nw+lYwEc8fjFifx4641dNn1jMQQ6KasVmbTFP/FliOI= =dAA0 -----END PGP SIGNATURE----- --5ojzgAU0AxESLaQoMOYnHoj5skqm5ArRg-- From nobody Fri Jun 28 11:48:03 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0DD5D1200FE for ; Fri, 28 Jun 2019 11:48:02 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.499 X-Spam-Level: X-Spam-Status: No, score=-17.499 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ww9QdGLjBmHk for ; Fri, 28 Jun 2019 11:47:58 -0700 (PDT) Received: from mail-ua1-x92e.google.com (mail-ua1-x92e.google.com [IPv6:2607:f8b0:4864:20::92e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 53A121200F1 for ; Fri, 28 Jun 2019 11:47:58 -0700 (PDT) Received: by mail-ua1-x92e.google.com with SMTP id f20so2574134ual.0 for ; Fri, 28 Jun 2019 11:47:58 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=T3gpmFcqhVLnDR4S/wPeoz2Oa/VnKgjV1zMhKzeeywI=; b=GqzzHoMROtef/bKYOlMKKKkNvdRHVqAVdPrkKkEjHd7LW+BJgpjva1lZqUrSfUWaoL f4xln6HtHR5UN+JSTCs7k84Sw/2T5feuwq7lhIH9WIQ9o20pawk+b/LBwFslKi1zNnsP 1Piq4y2rIPPPscR3b1jiHkfo6CD0lE232CDwTDqEGuboiWsvuL+51X3uzmHS0a4tlZta Ke8u1Q1FdxStiEubJiBVpY0OTNwNbOxz1uwyTsUoL4QCM/i5exG74ANoNC9l4TXFtKSb zTRYjzBrhG/o1pY8nn9b3hvXyS0Q0jMHdfNiR9oNkGacdPfJoGYmJPz8p1ICI6/lAepb Fu6Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=T3gpmFcqhVLnDR4S/wPeoz2Oa/VnKgjV1zMhKzeeywI=; b=Y7DpwOhIT/ZhI7UuMVlNPFPs8Bgm9/KPnzt7m4L1y0SKZoODgLWwqZcXvjJigvOW2t PQ8uZxdhJYh6w066rgShzZcdKBW9jhk/dmdHn2Q4tRk5o00uwhSkpkm808tYnt2hyp68 7sZTj2JOS7qHSFM8SH/O5JVxCOnNEOqhbxAjpoHvbzVGDuHstYReSeYFb0rZSFNIzF1f uCIGRW4/QAqrcJU2nVK0+0kFikT1fFfQ7+rwUCi9xAj2sbHKpqHrVXseW6pi4YcgQnKK 4/XmOsxqsCjgS1TxZBpRvSOyOYbncKvW7Qu5/HqOwpKUTq+i/Jx2H0gViSQ7vAkmDjyt 4HEA== X-Gm-Message-State: APjAAAVmHjWnr+Yn6ZhLbsF06o4f4MPa1jZUYsngTq8QJ6154TqxRyiU 7QRHcar6S00MrVF8TCM0IY6AM37re722i1ZeWwDTrImMvA4= X-Google-Smtp-Source: APXvYqy1Fw8b5pAyEt6n4EIE+kvxb14befDePPeCJ+0P9u8wyNe7ifwiZELwy2CZJ3wNv9nm/si4bIJs85wq7do4Wds= X-Received: by 2002:ab0:614d:: with SMTP id w13mr6251917uan.66.1561747677016; Fri, 28 Jun 2019 11:47:57 -0700 (PDT) MIME-Version: 1.0 References: <156173339678.20700.10472293883370612968.idtracker@ietfa.amsl.com> In-Reply-To: From: Ben Schwartz Date: Fri, 28 Jun 2019 14:47:45 -0400 Message-ID: To: Stephen Farrell Cc: "" Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha-256; boundary="0000000000008ceabb058c66b711" Archived-At: Subject: Re: [TLS] Fwd: New Version Notification for draft-schwartz-tls-lb-00.txt X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 28 Jun 2019 18:48:02 -0000 --0000000000008ceabb058c66b711 Content-Type: multipart/alternative; boundary="00000000000084f783058c66b7f3" --00000000000084f783058c66b7f3 Content-Type: text/plain; charset="UTF-8" On Fri, Jun 28, 2019 at 1:34 PM Stephen Farrell wrote: > > Hi Ben, > > Thanks for posting that - good to see a start on plugging > that gap. > > On 28/06/2019 17:52, Ben Schwartz wrote: > > Hi TLS, > > > > This is a proposal for a very simple new protocol whose main purpose is > to > > enable ESNI "split mode". Ultimately, I hope that this protocol can also > > enable more end-to-end TLS, by reducing the need for load-balancers to > > terminate TLS. > > I guess an alternative would be to wrap this metadata and > the TLS session in another possibly long-lived TLS session > between the LB and backend. That'd have the benefit of not > requiring a PSK, making correlation of the CH etc from TLS > client to LB with the LB to backend non-trivial(*), but I > guess at the cost of more CPU and per-packet overhead. > I agree with this analysis. There's also a significant memory overhead to maintain the extra TLS state. The fact that a network observer can so easily correlate > the inbound TLS packets to the LB with those outbound seems > like a fairly major downside of this approach to me. > This seems to me to be a threat modeling question, or maybe a question of how to trade off an expanded threat model against performance considerations. Overall, my feeling is that (1) This is an area where performance sensitivity is high (both at the load balancer and on the backend). (2) It's worth aiming for wide deployment, because the state of the art is TLS termination or metadata in plaintext :-(. (3) The effectiveness of layered encryption against a pervasive passive adversary is low, as you mention. Specifically, because client->load-balancer connection initiation triggers a load-balancer->backend connection setup, there is only ambiguity among the few connections that are initiated within milliseconds of each other, and subsequent traffic patterns are likely to disambiguate them. If you want to build an anonymizing TLS forwarder it would need long-lived connections, padding, chaff, and probably multiplexing. This is all within the realm of possibility but it seems like a much more difficult proposition. If you just want obfuscation, a possible middle ground would be to initialize a stream cipher from the PSK and let it run. For a small CPU cost and zero size overhead, this would give you defense against basic byte-matching. I think this is probably not worth it, but you can propose it to the group :-). The PSK would also make it hard to offer ESNI fronting to > random backends without pre-arrangement between the LB and > backend, should that be something someone wanted to do. I > think that would allow less centralised deployment of ESNI, > which I think is a pretty desirable option to preserve. > This is an interesting observation. Given that TLS-in-TLS is not TLS, the backend would still have to opt in to this system, but in principle it might accept incoming connections from anywhere. It's not obvious how clients would learn about these alternative ESNI hosts, but never mind that. I think this goal is reasonably achievable in the current 00 draft protocol. A site that wants to opt in just has to publish a PSK-vending endpoint wherever they would otherwise opt in. Then each load balancer can reach out to acquire a unique PSK. Also: a diagram would really help make the draft easier to > grok:-) > Point taken. Cheers, > S. > > (*) When I say non-trivial here I don't mean "very hard":-) > > > > > > > Please discuss. > > > > Thanks, > > Ben Schwartz > > > > ---------- Forwarded message --------- > > > > A new version of I-D, draft-schwartz-tls-lb-00.txt > > has been successfully submitted by Benjamin M. Schwartz and posted to the > > IETF repository. > > > > Name: draft-schwartz-tls-lb > > Revision: 00 > > Title: TLS Metadata for Load Balancers > > Document date: 2019-06-28 > > Group: Individual Submission > > Pages: 8 > > URL: > > https://www.ietf.org/internet-drafts/draft-schwartz-tls-lb-00.txt > > Status: https://datatracker.ietf.org/doc/draft-schwartz-tls-lb/ > > Htmlized: https://tools.ietf.org/html/draft-schwartz-tls-lb-00 > > Htmlized: > https://datatracker.ietf.org/doc/html/draft-schwartz-tls-lb > > > > > > Abstract: > > A load balancer that does not terminate TLS may wish to provide some > > information to the backend server, in addition to forwarding TLS > > data. This draft proposes a protocol between load balancers and > > backends that enables secure, efficient delivery of TLS with > > additional information. The need for such a protocol has recently > > become apparent in the context of split mode ESNI. > > > > > > > > > > Please note that it may take a couple of minutes from the time of > submission > > until the htmlized version and diff are available at tools.ietf.org. > > > > The IETF Secretariat > > > > > > _______________________________________________ > > TLS mailing list > > TLS@ietf.org > > https://www.ietf.org/mailman/listinfo/tls > > > --00000000000084f783058c66b7f3 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Fri, Jun 28, 2019 at 1:34 PM Stephen F= arrell <stephen.farrell@cs.= tcd.ie> wrote:

Hi Ben,

Thanks for posting that - good to see a start on plugging
that gap.

On 28/06/2019 17:52, Ben Schwartz wrote:
> Hi TLS,
>
> This is a proposal for a very simple new protocol whose main purpose i= s to
> enable ESNI "split mode".=C2=A0 Ultimately, I hope that this= protocol can also
> enable more end-to-end TLS, by reducing the need for load-balancers to=
> terminate TLS.

I guess an alternative would be to wrap this metadata and
the TLS session in another possibly long-lived TLS session
between the LB and backend. That'd have the benefit of not
requiring a PSK, making correlation of the CH etc from TLS
client to LB with the LB to backend non-trivial(*), but I
guess at the cost of more CPU and per-packet overhead.

I agree with this analysis.=C2=A0 There's also a signif= icant memory overhead to maintain the extra TLS state.

The fact that a network observer can so easily correlate
the inbound TLS packets to the LB with those outbound seems
like a fairly major downside of this approach to me.
<= br>
This seems to me to be a threat modeling question, or ma= ybe a question of how to trade off an expanded threat model against perform= ance considerations.

Overall, my feeling is that
(1) This is an area where performance sensitivity is high (both at= the load balancer and on the backend).
(2) It's worth aiming= for wide deployment, because the state of the art is TLS termination or me= tadata in plaintext :-(.
(3) The effectiveness of laye= red encryption against a pervasive passive adversary is low, as you mention= .=C2=A0 Specifically, because client->load-balancer connection initiatio= n triggers a load-balancer->backend connection setup, there is only ambi= guity among the few connections that are initiated within milliseconds of e= ach other, and subsequent traffic patterns are likely to disambiguate them.=

If you want to build an anonymizing TLS forwarder= it would need long-lived connections, padding, chaff, and probably multipl= exing.=C2=A0 This is all within the realm of possibility but it seems like = a much more difficult proposition.

If you just wan= t obfuscation, a possible middle ground would be to initialize a stream cip= her from the PSK and let it run.=C2=A0 For a small CPU cost and zero size o= verhead, this would give you defense against basic byte-matching.=C2=A0 I t= hink this is probably not worth it, but you can propose it to the group :-)= .

The PSK would also make it hard to offer ESNI fronting to
random backends without pre-arrangement between the LB and
backend, should that be something someone wanted to do. I
think that would allow less centralised deployment of ESNI,
which I think is a pretty desirable option to preserve.

This is an interesting observation.=C2=A0 Given that TLS-i= n-TLS is not TLS, the backend would still have to opt in to this system, bu= t in principle it might accept incoming connections from anywhere.=C2=A0 It= 's not obvious how clients would learn about these alternative ESNI hos= ts, but never mind that.

I think this goal is reas= onably achievable in the current 00 draft protocol.=C2=A0 A site that wants= to opt in just has to publish a PSK-vending endpoint wherever they would o= therwise opt in.=C2=A0 Then each load balancer=C2=A0can reach out to acquir= e a unique PSK.=C2=A0

Also: a diagram would really help make the draft easier to
grok:-)

Point taken.

Cheers,
S.

(*) When I say non-trivial here I don't mean "very hard":-)


>
> Please discuss.
>
> Thanks,
> Ben Schwartz
>
> ---------- Forwarded message ---------
>
> A new version of I-D, draft-schwartz-tls-lb-00.txt
> has been successfully submitted by Benjamin M. Schwartz and posted to = the
> IETF repository.
>
> Name:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0draft-schwartz-tls-lb > Revision:=C2=A0 =C2=A0 =C2=A0 =C2=A000
> Title:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 TLS Metadata for Load Balance= rs
> Document date:=C2=A0 2019-06-28
> Group:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 Individual Submission
> Pages:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 8
> URL:
> https://www.ietf.org/internet-= drafts/draft-schwartz-tls-lb-00.txt
> Status:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0https://datatracker.ietf.org/doc/draft-schwartz-tls-lb/
> Htmlized:=C2=A0 =C2=A0 =C2=A0 =C2=A0https:/= /tools.ietf.org/html/draft-schwartz-tls-lb-00
> Htmlized:=C2=A0 =C2=A0 =C2=A0 =C2=A0= https://datatracker.ietf.org/doc/html/draft-schwartz-tls-lb
>
>
> Abstract:
>=C2=A0 =C2=A0 A load balancer that does not terminate TLS may wish to p= rovide some
>=C2=A0 =C2=A0 information to the backend server, in addition to forward= ing TLS
>=C2=A0 =C2=A0 data.=C2=A0 This draft proposes a protocol between load b= alancers and
>=C2=A0 =C2=A0 backends that enables secure, efficient delivery of TLS w= ith
>=C2=A0 =C2=A0 additional information.=C2=A0 The need for such a protoco= l has recently
>=C2=A0 =C2=A0 become apparent in the context of split mode ESNI.
>
>
>
>
> Please note that it may take a couple of minutes from the time of subm= ission
> until the htmlized version and diff are available at tools.ietf.org. >
> The IETF Secretariat
>
>
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls
>
--00000000000084f783058c66b7f3-- --0000000000008ceabb058c66b711 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIIS5wYJKoZIhvcNAQcCoIIS2DCCEtQCAQExDzANBglghkgBZQMEAgEFADALBgkqhkiG9w0BBwGg ghBNMIIEXDCCA0SgAwIBAgIOSBtqDm4P/739RPqw/wcwDQYJKoZIhvcNAQELBQAwZDELMAkGA1UE BhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExOjA4BgNVBAMTMUdsb2JhbFNpZ24gUGVy c29uYWxTaWduIFBhcnRuZXJzIENBIC0gU0hBMjU2IC0gRzIwHhcNMTYwNjE1MDAwMDAwWhcNMjEw NjE1MDAwMDAwWjBMMQswCQYDVQQGEwJCRTEZMBcGA1UEChMQR2xvYmFsU2lnbiBudi1zYTEiMCAG A1UEAxMZR2xvYmFsU2lnbiBIViBTL01JTUUgQ0EgMTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC AQoCggEBALR23lKtjlZW/17kthzYcMHHKFgywfc4vLIjfq42NmMWbXkNUabIgS8KX4PnIFsTlD6F GO2fqnsTygvYPFBSMX4OCFtJXoikP2CQlEvO7WooyE94tqmqD+w0YtyP2IB5j4KvOIeNv1Gbnnes BIUWLFxs1ERvYDhmk+OrvW7Vd8ZfpRJj71Rb+QQsUpkyTySaqALXnyztTDp1L5d1bABJN/bJbEU3 Hf5FLrANmognIu+Npty6GrA6p3yKELzTsilOFmYNWg7L838NS2JbFOndl+ce89gM36CW7vyhszi6 6LqqzJL8MsmkP53GGhf11YMP9EkmawYouMDP/PwQYhIiUO0CAwEAAaOCASIwggEeMA4GA1UdDwEB /wQEAwIBBjAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwQwEgYDVR0TAQH/BAgwBgEB/wIB ADAdBgNVHQ4EFgQUyzgSsMeZwHiSjLMhleb0JmLA4D8wHwYDVR0jBBgwFoAUJiSSix/TRK+xsBtt r+500ox4AAMwSwYDVR0fBEQwQjBAoD6gPIY6aHR0cDovL2NybC5nbG9iYWxzaWduLmNvbS9ncy9n c3BlcnNvbmFsc2lnbnB0bnJzc2hhMmcyLmNybDBMBgNVHSAERTBDMEEGCSsGAQQBoDIBKDA0MDIG CCsGAQUFBwIBFiZodHRwczovL3d3dy5nbG9iYWxzaWduLmNvbS9yZXBvc2l0b3J5LzANBgkqhkiG 9w0BAQsFAAOCAQEACskdySGYIOi63wgeTmljjA5BHHN9uLuAMHotXgbYeGVrz7+DkFNgWRQ/dNse Qa4e+FeHWq2fu73SamhAQyLigNKZF7ZzHPUkSpSTjQqVzbyDaFHtRBAwuACuymaOWOWPePZXOH9x t4HPwRQuur57RKiEm1F6/YJVQ5UTkzAyPoeND/y1GzXS4kjhVuoOQX3GfXDZdwoN8jMYBZTO0H5h isymlIl6aot0E5KIKqosW6mhupdkS1ZZPp4WXR4frybSkLejjmkTYCTUmh9DuvKEQ1Ge7siwsWgA NS1Ln+uvIuObpbNaeAyMZY0U5R/OyIDaq+m9KXPYvrCZ0TCLbcKuRzCCBB4wggMGoAMCAQICCwQA AAAAATGJxkCyMA0GCSqGSIb3DQEBCwUAMEwxIDAeBgNVBAsTF0dsb2JhbFNpZ24gUm9vdCBDQSAt IFIzMRMwEQYDVQQKEwpHbG9iYWxTaWduMRMwEQYDVQQDEwpHbG9iYWxTaWduMB4XDTExMDgwMjEw MDAwMFoXDTI5MDMyOTEwMDAwMFowZDELMAkGA1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24g bnYtc2ExOjA4BgNVBAMTMUdsb2JhbFNpZ24gUGVyc29uYWxTaWduIFBhcnRuZXJzIENBIC0gU0hB MjU2IC0gRzIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCg/hRKosYAGP+P7mIdq5NB Kr3J0tg+8lPATlgp+F6W9CeIvnXRGUvdniO+BQnKxnX6RsC3AnE0hUUKRaM9/RDDWldYw35K+sge C8fWXvIbcYLXxWkXz+Hbxh0GXG61Evqux6i2sKeKvMr4s9BaN09cqJ/wF6KuP9jSyWcyY+IgL6u2 52my5UzYhnbf7D7IcC372bfhwM92n6r5hJx3r++rQEMHXlp/G9J3fftgsD1bzS7J/uHMFpr4MXua eoiMLV5gdmo0sQg23j4pihyFlAkkHHn4usPJ3EePw7ewQT6BUTFyvmEB+KDoi7T4RCAZDstgfpzD rR/TNwrK8/FXoqnFAgMBAAGjgegwgeUwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8C AQEwHQYDVR0OBBYEFCYkkosf00SvsbAbba/udNKMeAADMEcGA1UdIARAMD4wPAYEVR0gADA0MDIG CCsGAQUFBwIBFiZodHRwczovL3d3dy5nbG9iYWxzaWduLmNvbS9yZXBvc2l0b3J5LzA2BgNVHR8E LzAtMCugKaAnhiVodHRwOi8vY3JsLmdsb2JhbHNpZ24ubmV0L3Jvb3QtcjMuY3JsMB8GA1UdIwQY MBaAFI/wS3+oLkUkrk1Q+mOai97i3Ru8MA0GCSqGSIb3DQEBCwUAA4IBAQACAFVjHihZCV/IqJYt 7Nig/xek+9g0dmv1oQNGYI1WWeqHcMAV1h7cheKNr4EOANNvJWtAkoQz+076Sqnq0Puxwymj0/+e oQJ8GRODG9pxlSn3kysh7f+kotX7pYX5moUa0xq3TCjjYsF3G17E27qvn8SJwDsgEImnhXVT5vb7 qBYKadFizPzKPmwsJQDPKX58XmPxMcZ1tG77xCQEXrtABhYC3NBhu8+c5UoinLpBQC1iBnNpNwXT Lmd4nQdf9HCijG1e8myt78VP+QSwsaDT7LVcLT2oDPVggjhVcwljw3ePDwfGP9kNrR+lc8XrfClk WbrdhC2o4Ui28dtIVHd3MIIDXzCCAkegAwIBAgILBAAAAAABIVhTCKIwDQYJKoZIhvcNAQELBQAw TDEgMB4GA1UECxMXR2xvYmFsU2lnbiBSb290IENBIC0gUjMxEzARBgNVBAoTCkdsb2JhbFNpZ24x EzARBgNVBAMTCkdsb2JhbFNpZ24wHhcNMDkwMzE4MTAwMDAwWhcNMjkwMzE4MTAwMDAwWjBMMSAw HgYDVQQLExdHbG9iYWxTaWduIFJvb3QgQ0EgLSBSMzETMBEGA1UEChMKR2xvYmFsU2lnbjETMBEG A1UEAxMKR2xvYmFsU2lnbjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMwldpB5Bngi FvXAg7aEyiie/QV2EcWtiHL8RgJDx7KKnQRfJMsuS+FggkbhUqsMgUdwbN1k0ev1LKMPgj0MK66X 17YUhhB5uzsTgHeMCOFJ0mpiLx9e+pZo34knlTifBtc+ycsmWQ1z3rDI6SYOgxXG71uL0gRgykmm KPZpO/bLyCiR5Z2KYVc3rHQU3HTgOu5yLy6c+9C7v/U9AOEGM+iCK65TpjoWc4zdQQ4gOsC0p6Hp sk+QLjJg6VfLuQSSaGjlOCZgdbKfd/+RFO+uIEn8rUAVSNECMWEZXriX7613t2Saer9fwRPvm2L7 DWzgVGkWqQPabumDk3F2xmmFghcCAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQF MAMBAf8wHQYDVR0OBBYEFI/wS3+oLkUkrk1Q+mOai97i3Ru8MA0GCSqGSIb3DQEBCwUAA4IBAQBL QNvAUKr+yAzv95ZURUm7lgAJQayzE4aGKAczymvmdLm6AC2upArT9fHxD4q/c2dKg8dEe3jgr25s bwMpjjM5RcOO5LlXbKr8EpbsU8Yt5CRsuZRj+9xTaGdWPoO4zzUhw8lo/s7awlOqzJCK6fBdRoyV 3XpYKBovHd7NADdBj+1EbddTKJd+82cEHhXXipa0095MJ6RMG3NzdvQXmcIfeg7jLQitChws/zyr VQ4PkX4268NXSb7hLi18YIvDQVETI53O9zJrlAGomecsMx86OyXShkDOOyyGeMlhLxS67ttVb9+E 7gUJTb0o2HLO02JQZR7rkpeDMdmztcpHWD9fMIIEZDCCA0ygAwIBAgIMB/CJK1MgpV83jiIZMA0G CSqGSIb3DQEBCwUAMEwxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9iYWxTaWduIG52LXNhMSIw IAYDVQQDExlHbG9iYWxTaWduIEhWIFMvTUlNRSBDQSAxMB4XDTE5MDMxMzA4MjIxOVoXDTE5MDkw OTA4MjIxOVowIjEgMB4GCSqGSIb3DQEJAQwRYmVtYXNjQGdvb2dsZS5jb20wggEiMA0GCSqGSIb3 DQEBAQUAA4IBDwAwggEKAoIBAQCsphkGEsCh0fF4+6Wsi1u40JxI6W6Izew+dLGK4b93LCRAuJ8y g9wSnwGAtk9/23VmtKwBrMaJD5j9SVZpscvLAjrWwADl/THU22uTW0MsUE2fPOPv2s4hE+vMgRmK P2E+xpI6n0gFvn8qrUHO1dm6PJaP5SWa+zdB/Ja1LgMJTpevQqjK4LKjWmHFPR6CplS4RImjGk7U 0I6invTyQnL5p583t5PI7FcM5UyjAqxGEETdAuc7N4IqjNETvPwL0wLIzxPDA5PMqcWPSzg7sBAB LVUQRYNIAJPlVpUdg1IeAjil5BaaWBjEeCLBSGDFX3WaWfMNzQvRZr4i6oJxzV+1AgMBAAGjggFu MIIBajAcBgNVHREEFTATgRFiZW1hc2NAZ29vZ2xlLmNvbTBQBggrBgEFBQcBAQREMEIwQAYIKwYB BQUHMAKGNGh0dHA6Ly9zZWN1cmUuZ2xvYmFsc2lnbi5jb20vY2FjZXJ0L2dzaHZzbWltZWNhMS5j cnQwHQYDVR0OBBYEFFSy8ovdLNSQc8aqxOgKS7sBOm/UMB8GA1UdIwQYMBaAFMs4ErDHmcB4koyz IZXm9CZiwOA/MEwGA1UdIARFMEMwQQYJKwYBBAGgMgEoMDQwMgYIKwYBBQUHAgEWJmh0dHBzOi8v d3d3Lmdsb2JhbHNpZ24uY29tL3JlcG9zaXRvcnkvMDsGA1UdHwQ0MDIwMKAuoCyGKmh0dHA6Ly9j cmwuZ2xvYmFsc2lnbi5jb20vZ3NodnNtaW1lY2ExLmNybDAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0l BBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMEMA0GCSqGSIb3DQEBCwUAA4IBAQCbQ++Znz6xh85ZlZEN Y/vAF0vn111O0c2houe4LlLQkoQ1QS4fH5EYcBx/393FTq5n08ezWYVtmeQ6W15e34CqjYNop1Vh mihZ+3J6+LL/6YNi91cp5yMFgxOP9aI/Y8IaIWZJAY2e8yHbYSq0z8kka0H6S4VvFjwtRogkWW95 0SStEwo/8viJ02BwpmVj4YIA6Fva1ZbeN2TnUMCAHJAlKWOGlpHxpcdcWckED0XbSY9w6bllMw1T tsbiUwQxDeO++Y8NfS8rieZgfv3RlobKihE8xbIVGRHIq1gup4nXv6XDwHDYyGhafIfUD4Ix00Wk gnODGb+jPwoQlDX0X64qMYICXjCCAloCAQEwXDBMMQswCQYDVQQGEwJCRTEZMBcGA1UEChMQR2xv YmFsU2lnbiBudi1zYTEiMCAGA1UEAxMZR2xvYmFsU2lnbiBIViBTL01JTUUgQ0EgMQIMB/CJK1Mg pV83jiIZMA0GCWCGSAFlAwQCAQUAoIHUMC8GCSqGSIb3DQEJBDEiBCChmzb3rQaziH2hwRtNxVCK tl8y6w5iAujt4I+53XKyzjAYBgkqhkiG9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEP Fw0xOTA2MjgxODQ3NTdaMGkGCSqGSIb3DQEJDzFcMFowCwYJYIZIAWUDBAEqMAsGCWCGSAFlAwQB FjALBglghkgBZQMEAQIwCgYIKoZIhvcNAwcwCwYJKoZIhvcNAQEKMAsGCSqGSIb3DQEBBzALBglg hkgBZQMEAgEwDQYJKoZIhvcNAQEBBQAEggEAafkg0C9QPTYIqjwJcJ9jqmhZBfSnZnqBdlnGrwS9 1E/c1L8yxQoO01Exz04+vAWqD9YU+Khgy4xx19HKYhrAALqLqGLMwl799KrJsHg0NC2fl47uW9Zp VfmGE5KpzLnBYONFtTe8W5yhMIPnWpZekvNldJBMmctZqAaSty+Kx7HcdG75UoClnD/6EoeZb7or ucjVSRXJw1AkmjO4eA0ZEIRjB7zfcslFqjxn3Ti3EUgUKDIOofsymvzYTvF0XYgX70D2faX88em4 qC/E4cJ93wtWoG5hluEZ6lfloXOjIjUO7o1AhykcdjhfqI6xhnLhnht5Ohfyw32jf/PdZXBZ4w== --0000000000008ceabb058c66b711-- From nobody Fri Jun 28 12:22:48 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 86406120850 for ; Fri, 28 Jun 2019 12:22:47 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.299 X-Spam-Level: X-Spam-Status: No, score=-4.299 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TdxH0gvlIK1U for ; Fri, 28 Jun 2019 12:22:44 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4E058120473 for ; Fri, 28 Jun 2019 12:22:43 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id 018FABE39; Fri, 28 Jun 2019 20:22:41 +0100 (IST) X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bJteyW3Iqo1T; Fri, 28 Jun 2019 20:22:38 +0100 (IST) Received: from [10.244.2.138] (95-45-153-252-dynamic.agg2.phb.bdt-fng.eircom.net [95.45.153.252]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id 21483BE2E; Fri, 28 Jun 2019 20:22:38 +0100 (IST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1561749758; bh=J/V85x4MxhLBMA6hWylcJxV2DIsgnx3CkNBel1ny+eM=; h=To:Cc:References:From:Subject:Date:In-Reply-To:From; b=PJv9uOgU+zHYOneuH7j+BCL14RCNTMtC0eTRKyI2LE4B2kq3aujLAJoXD1CfKsC2l XGR78Mu9t34SywUc6qTrLy4b08jNOCl+9qDZszZfVAqANjvG6v02TO9ZaDFCQYDwbf F1Hh9glX6cZe2pt0mMfzMmB5Qy6urKn+/Ay1wi4s= To: Ben Schwartz Cc: "" References: <156173339678.20700.10472293883370612968.idtracker@ietfa.amsl.com> From: Stephen Farrell Openpgp: id=5BB5A6EA5765D2C5863CAE275AB2FAF17B172BEA; url= Autocrypt: addr=stephen.farrell@cs.tcd.ie; prefer-encrypt=mutual; keydata= mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nemCP5PMvmh 5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kTq0IqYzsEv5HI58S+ QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtEgvw4fVhVWJuyy3w//0F2tzKr EMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy+pAh4EKzS1FE7BOZp9daMu9MUQmDqtZU bUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqO Vz+7L+WiVfxLbeVqBwV+4uL9to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJg b097ZaNyuY1ETghVB5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k 4LyM2lp5FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9tlyWxn5Xi HzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQABtDJTdGVwaGVuIEZh cnJlbGwgKDIwMTcpIDxzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPokCQAQTAQgAKgIbAwUJ CZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAUCWj6jdwIZAQAKCRBasvrxexcr6o7QD/9m x9DPJetmW794RXmNTrbTJ44zc/tJbcLdRBh0KBn9OW/EaAqjDmgNJeCMyJTKr1ywaps8HGUN hLEVkc14NUpgi4/Zkrbi3DmTp25OHj6wXBS5qVMyVynTMEIjOfeFFyxG+48od+Xn7qg6LT7G rHeNf+z/r0v9+8eZ1Ip63kshQDGhhpmRMKu4Ws9ZvTW2ACXkkTFaSGYJj3yIP4R6IgwBYGMz DXFX6nS4LA1s3pcPNxOgrvCyb60AiJZTLcOk/rRrpZtXB1XQc23ZZmrlTkl2HaThL6w3YKdi Ti1NbuMeOxZqtXcUshII45sANm4HuWNTiRh93Bn5bN6ddjgsaXEZBKUBuUaPBl7gQiQJcAlS 3MmGgVS4ZoX8+VaPGpXdQVFyBMRFlOKOC5XJESt7wY0RE2C8PFm+5eywSO/P1fkl9whkMgml 3OEuIQiP2ehRt/HVLMHkoM9CPQ7t6UwdrXrvX+vBZykav8x9U9M6KTgfsXytxUl6Vx5lPMLi 2/Jrsz6Mzh/IVZa3xjhq1OLFSI/tT2ji4FkJDQbO+yYUDhcuqfakDmtWLMxecZsY6O58A/95 8Qni6Xeq+Nh7zJ7wNcQOMoDGj+24di2TX1cKLzdDMWFaWzlNP5dB5VMwS9Wqj1Z6TzKjGjru q8soqohwb2CK9B3wzFg0Bs1iBI+2RuFnxLkCDQRaPVAyARAA+g3R0HzGr/Dl34Y07XqGqzq5 SU0nXIu9u8Ynsxj7gR5qb3HgUWYEWrHW2jHOByXnvkffucf5yzwrsvw8Q8iI8CFHiTYHPpey 4yPVn6R0w/FOMcY70eTIu/k6EEFDlDbs09DtKcrsT9bmN0XoRxITlXwWTufYqUnmS+YkAuk+ TLCtUin7OdaS2uU6Ata3PLQSeM2ZsUQMmYmHPwB9rmf+q2I005AJ9Q1SPQ2KNg/8xOGxo13S VuaSqYRQdpV93RuCOzg4vuXtR+gP0KQrus/P2ZCEPvU9cXF/2MIhXgOz207lv3iE2zGyNXld /n8spvWk+0bH5Zqd9Wcba/rGcBhmX9NKKDARZqjkv/zVEP1X97w1HsNYeUFNcg2lk9zQKb4v l1jx/Uz8ukzH2QNhU4R39dbF/4AwWuSVkGW6bTxHJqGs6YimbfdQqxTzmqFwz3JP0OtXX5q/ 6D4pHwcmJwEiDNzsBLl6skPSQ0Xyq3pua/qAP8MVm+YxCxJQITqZ8qjDLzoe7s9X6FLLC/DA L9kxl5saVSfDbuI3usH/emdtn0NA9/M7nfgih92zD92sl1yQXHT6BDa8xW1j+RU4P+E0wyd7 zgB2UeYgrp2IIcfG+xX2uFG5MJQ/nYfBoiALb0+dQHNHDtFnNGY3Oe8z1M9c5aDG3/s29QbJ +w7hEKKo9YMAEQEAAYkCJQQYAQgADwUCWj1QMgIbDAUJCZQmAAAKCRBasvrxexcr6qwvD/9b Rek3kfN8Q+jGrKl8qwY8HC5s4mhdDJZI/JP2FImf5J2+d5/e8UJ4fcsT79E0/FqX3Z9wZr6h sofPqLh1/YzDsYkZDHTYSGrlWGP/I5kXwUmFnBZHzM3WGrL3S7ZmCYMdudhykxXXjq7M6Do1 oxM8JofrXGtwBTLv5wfvvygJouVCVe87Ge7mCeY5vey1eUi4zSSF1zPpR6gg64w2g4TXM5qt SwkZVOv1g475LsGlYWRuJV8TA67yp1zJI7HkNqCo8KyHX0DPOh9c+Sd9ZX4aqKfqH9HIpnCL AYEgj7vofeix7gM3kQQmwynqq32bQGQBrKJEYp2vfeO30VsVx4dzuuiC5lyjUccVmw5D72J0 FlGrfEm0kw6D1qwyBg0SAMqamKN6XDdjhNAtXIaoA2UMZK/vZGGUKbqTgDdk0fnzOyb2zvXK CiPFKqIPAqKaDHg0JHdGI3KpQdRNLLzgx083EqEc6IAwWA6jSz+6lZDV6XDgF0lYqAYIkg3+ 6OUXUv6plMlwSHquiOc/MQXHfgUP5//Ra5JuiuyCj954FD+MBKIj8eWROfnzyEnBplVHGSDI ZLzL3pvV14dcsoajdeIH45i8DxnVm64BvEFHtLNlnliMrLOrk4shfmWyUqNlzilXN2BTFVFH 4MrnagFdcFnWYp1JPh96ZKjiqBwMv/H0kw== Message-ID: <9b845420-91a6-d8aa-54d2-4300bdf53e68@cs.tcd.ie> Date: Fri, 28 Jun 2019 20:22:36 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.7.1 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="gVC2mNrf6QWQtskhS1eckXPiANeao359L" Archived-At: Subject: Re: [TLS] Fwd: New Version Notification for draft-schwartz-tls-lb-00.txt X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 28 Jun 2019 19:22:48 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --gVC2mNrf6QWQtskhS1eckXPiANeao359L Content-Type: multipart/mixed; boundary="JmIcQx72sEyt9BGwnNBd0Lt0XXEwQk1i9"; protected-headers="v1" From: Stephen Farrell To: Ben Schwartz Cc: "" Message-ID: <9b845420-91a6-d8aa-54d2-4300bdf53e68@cs.tcd.ie> Subject: Re: [TLS] Fwd: New Version Notification for draft-schwartz-tls-lb-00.txt References: <156173339678.20700.10472293883370612968.idtracker@ietfa.amsl.com> In-Reply-To: --JmIcQx72sEyt9BGwnNBd0Lt0XXEwQk1i9 Content-Type: multipart/mixed; boundary="------------52A715765E2CB93121294112" Content-Language: en-GB This is a multi-part message in MIME format. --------------52A715765E2CB93121294112 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hiya, On 28/06/2019 19:47, Ben Schwartz wrote: > On Fri, Jun 28, 2019 at 1:34 PM Stephen Farrell > wrote: >=20 >> >> Hi Ben, >> >> Thanks for posting that - good to see a start on plugging >> that gap. >> >> On 28/06/2019 17:52, Ben Schwartz wrote: >>> Hi TLS, >>> >>> This is a proposal for a very simple new protocol whose main purpose = is >> to >>> enable ESNI "split mode". Ultimately, I hope that this protocol can = also >>> enable more end-to-end TLS, by reducing the need for load-balancers t= o >>> terminate TLS. >> >> I guess an alternative would be to wrap this metadata and >> the TLS session in another possibly long-lived TLS session >> between the LB and backend. That'd have the benefit of not >> requiring a PSK, making correlation of the CH etc from TLS >> client to LB with the LB to backend non-trivial(*), but I >> guess at the cost of more CPU and per-packet overhead. >> >=20 > I agree with this analysis. There's also a significant memory overhead= to > maintain the extra TLS state. Fair point. >=20 > The fact that a network observer can so easily correlate >> the inbound TLS packets to the LB with those outbound seems >> like a fairly major downside of this approach to me. >> >=20 > This seems to me to be a threat modeling question, or maybe a question = of > how to trade off an expanded threat model against performance > considerations. >=20 > Overall, my feeling is that > (1) This is an area where performance sensitivity is high (both at the = load > balancer and on the backend). > (2) It's worth aiming for wide deployment, because the state of the art= is > TLS termination or metadata in plaintext :-(. > (3) The effectiveness of layered encryption against a pervasive passive= > adversary is low, as you mention. Specifically, because > client->load-balancer connection initiation triggers a > load-balancer->backend connection setup, there is only ambiguity among = the > few connections that are initiated within milliseconds of each other, a= nd > subsequent traffic patterns are likely to disambiguate them. That's a reasonable argument. I'm not yet convinced it's where we want to land myself though. >=20 > If you want to build an anonymizing TLS forwarder it would need long-li= ved > connections, padding, chaff, and probably multiplexing. This is all wi= thin > the realm of possibility but it seems like a much more difficult > proposition. Right. A TLS-in-TLS approach to split mode ESNI could be a step on that road. I'm not arguing that's a winning argument but I do think we ought tease it out. If we go back 2 or 3 years we concluded ESNI wasn't doable, but turns out it was. Not sure if there's anything practical we can do about the correlation problem in split-mode ESNI but we should think about it, and recognise it as a real issue. That reminds me: if you put out a -01, describing all that in the (missing:-) security considerations section would be a fine thing. >=20 > If you just want obfuscation, a possible middle ground would be to > initialize a stream cipher from the PSK and let it run. For a small CP= U > cost and zero size overhead, this would give you defense against basic > byte-matching. I think this is probably not worth it, but you can prop= ose > it to the group :-). Nah, don't think I'd go for that either. Either a light-weight prepend-stuff approach like yours (but with better than a PSK), or else a TLS-in-TLS with the associated costs and benefits seem like the options here. >=20 > The PSK would also make it hard to offer ESNI fronting to >> random backends without pre-arrangement between the LB and >> backend, should that be something someone wanted to do. I >> think that would allow less centralised deployment of ESNI, >> which I think is a pretty desirable option to preserve. >> >=20 > This is an interesting observation. Given that TLS-in-TLS is not TLS, = the > backend would still have to opt in to this system, but in principle it > might accept incoming connections from anywhere. It's not obvious how > clients would learn about these alternative ESNI hosts, but never mind = that. Not a problem. The LB/fronter just has to publish it's ESNIKeys and then the backend publishes that RR value in the DNS. So the TLS client doesn't need to know that the LB/public_name and backend do/don't have a prearranged deal. >=20 > I think this goal is reasonably achievable in the current 00 draft > protocol. A site that wants to opt in just has to publish a PSK-vendin= g > endpoint wherever they would otherwise opt in. Then each load balancer= can > reach out to acquire a unique PSK. Not sure I get what you mean there, but yes, if we follow the approach taken in your I-D, I would argue that such a key establishment mechanism would be needed, and I'd be shocked if that wasn't based on TLS:-) Cheers, S. >=20 > Also: a diagram would really help make the draft easier to >> grok:-) >> >=20 > Point taken. >=20 > Cheers, >> S. >> >> (*) When I say non-trivial here I don't mean "very hard":-) >> >> >> >>> >>> Please discuss. >>> >>> Thanks, >>> Ben Schwartz >>> >>> ---------- Forwarded message --------- >>> >>> A new version of I-D, draft-schwartz-tls-lb-00.txt >>> has been successfully submitted by Benjamin M. Schwartz and posted to= the >>> IETF repository. >>> >>> Name: draft-schwartz-tls-lb >>> Revision: 00 >>> Title: TLS Metadata for Load Balancers >>> Document date: 2019-06-28 >>> Group: Individual Submission >>> Pages: 8 >>> URL: >>> https://www.ietf.org/internet-drafts/draft-schwartz-tls-lb-00.txt >>> Status: https://datatracker.ietf.org/doc/draft-schwartz-tls-l= b/ >>> Htmlized: https://tools.ietf.org/html/draft-schwartz-tls-lb-00 >>> Htmlized: >> https://datatracker.ietf.org/doc/html/draft-schwartz-tls-lb >>> >>> >>> Abstract: >>> A load balancer that does not terminate TLS may wish to provide so= me >>> information to the backend server, in addition to forwarding TLS >>> data. This draft proposes a protocol between load balancers and >>> backends that enables secure, efficient delivery of TLS with >>> additional information. The need for such a protocol has recently= >>> become apparent in the context of split mode ESNI. >>> >>> >>> >>> >>> Please note that it may take a couple of minutes from the time of >> submission >>> until the htmlized version and diff are available at tools.ietf.org. >>> >>> The IETF Secretariat >>> >>> >>> _______________________________________________ >>> TLS mailing list >>> TLS@ietf.org >>> https://www.ietf.org/mailman/listinfo/tls >>> >> >=20 --------------52A715765E2CB93121294112 Content-Type: application/pgp-keys; name="0x5AB2FAF17B172BEA.asc" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="0x5AB2FAF17B172BEA.asc" -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nem CP5PMvmh5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kT q0IqYzsEv5HI58S+QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtE gvw4fVhVWJuyy3w//0F2tzKrEMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy +pAh4EKzS1FE7BOZp9daMu9MUQmDqtZUbUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5 iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqOVz+7L+WiVfxLbeVqBwV+4uL9 to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJgb097ZaNyuY1ETghV B5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k4LyM2lp5 FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9t lyWxn5XiHzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQAB tCFTdGVwaGVuIEZhcnJlbGwgPHN0ZXBoZW5AamVsbC5pZT6JAj0EEwEIACcFAlo9 UYwCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQWrL68XsXK+qG CxAApYHWYgGOIL3G6/OpkejdAkQoCVQAK8LJUSf6vzwost4iVfxIKcKW/3RqKNKk rRl8beJ7j1CWXAz9+VXAOsE9+zNxXIDgGA7HlvJnhffl+qwibVgiHgUcJFhCSbBr sjC+1uULaTU8zYEyET//GOGPLF+X+degkE/sesh4zcEAjF7fGPnlncdCCH3tvPZZ sdTcjwOCRVonKsDgQzBTCMz/RPBfEFX44HZx4g1UQAcCA4xlucY8QkJEyCrSNGpG nvGK8DcGSmnstl1/a9fnlhpdFxieX3oY2phJ1WKkYTn6Advrek3UP71CKxpgtPmk d3iUUz/VZa0Cv6YxQXskspRDVEvdCMYSQBtJPQ4y2+5UxVR9GIQXenwYp9AP2niv Voh+ITsDWWeWnnvYMq07rSDjq0nGdj41MJkNX+Yb2PXVyXItcj5ybE3T2+y3pSBG FEZYJGuaL4NwtBJFMOdOtBmUOPbetS2971EL3Izxb7ibOZWDwexv+8R6SWYfP1wV N3p46RyBQuXqJV8ccE11m6vtZTGSYgnLUUFZMRQYH+0hwuYe0T3AA18xDdSYsa8v ovCCd3l5S4UNzIM2PMChqGrEzKapUpZg7+8ACcxRU3b9Ihd7WYjJ+pQPCoWYKozv tEvenbNpE/govO/ED3B14e+R2yevRPjRrsN7PJzSf15fQLuJARwEEAEIAAYFAlo9 UqAACgkQLzyHNoBfjaLrSwf+MIHbFRQ4O5cmLYR5sIByWelN3SuRN/gW8rpKo9Ok Cz6An8uV/iCXy5tNMLzzi0BFl8f22DwBcC5qy9qnlIAdogWam1qWoTAoAD8veEqm uKhYrqJsCcAyNrKYmK0hP3rpHxx1LySDmKYXmw/8qtBXKHTouMm+5tSsznhykRMT AAr2p7PSaHgo+hIVaW/rKSspHjDhhZS+G9mtOZad1IH29M6G1Q1NCO0Ywe8krKLQ IAQlFxtgvOqpPOZNzeKBa/+KbE8TGgMWrkOhC8OeEM5PVzdDhlhD9kPzB/pCKDF5 DofJ/ZRqnDpbKPQ0bsW38AOig3kOc0A27awiBEw3urqR1YkCMwQQAQgAHRYhBH4X CgRchM9GDit5oBDvedn9g1MSBQJbtyScAAoJEBDvedn9g1MSI/oP/0A9J9nrnBMq Zpm857lfYWw+rshLK+tyeP4OQeOqnDFvs9jePpcyJLG3DF2r6VbVKPQq+AE6Uf5h cJBDEN6BjEhRPSbLcqG3A1cz/nNwm8rPmNp+oKhmaBBQGxwciMLmzgynsDydnjPp MyEs04zvsbsl4vrp2095o105l8KcrrxQrioFjbwveGwHQK9bxJKhx9D+gIk+MouB ur45UDKTZkMZrr9FGrtkyXCGAxvKdcNC5Oa8z9sj1rcUJfG/OpVAMWhArdlZbFUQ yoX6pU2Zb1CR2qpWAVerGSfBhmfCyStjARqaKxlftjO+Bj3Jj73Cr5eqej3qB5+V 4BCsPjr4RLvVbYUCPsRdxWc+nBLlfVYkRURu21g1hFm5KFPjgUkyo1s4vjUOY8Dy I+xLGF7f/IhUBG6l+Vswhpwu7ydalZkeFiPx5xna5NfbEYxvsIf71DvipGvIOaHv X4egWoFgm8n/9c3rcMxJtpwHPSsUt5dgLsyu6VE0IbvOAc3dN7CWJ355DVFJq9Zg 2YVf0izSpyyzJeGsgkfjW6xpmdvZxuT2UcN4BTcm6vYqueASGrb3lfhzC5gpeVsc /MoSjTS65vNWbpzONZWMZuLEFraxWJzC0JrDK3NCd0VN3kstqGkVbUIiYOnUm8Vu 4zoVMLlGWzHLIGoPRG2nRezn1YyNfyb5iQGcBBABCgAGBQJbxcflAAoJEGo7ETk8 pK1gE7QL/ApC5P68W5DrI1787WJVZv1u4t/g39vTr7Xer3UMTVQg10vpa7pmqOGh jIDzDMg3Pe3K3M7fVzfAlUA1qw6ne4RCueVoRKpubeF4AlYbMr0K6hNCPjt5uAxm bBVuejKTc6pru5rv5gKL0nDbr+Snft5xt7juBLSSimw0/41sZnkjCxo9rF/RA/v6 +uWyK171RKmsEYu8fFtw1eqUNt/Xj792TUixE3pxXheNtQtZGk/9P3W83ChhG4Fh 5EQsn0pIh9wZIAbMRLpgRKyW87fWHZC8/YH8h7afarvn9Thl5pFUldCe22mNJj6K LChn2aEHQd+PdY1GBpZEcmNEUPuovwzatM0h64hCzTm41eDqRfihZVBT7TbfXQnv 8rywa42Mk756RGzzEZcQEhwQXZcMQUfxIQQ2VyJo0zG36VdZTQF7TF/4Lz7/3cJ5 6jOIm+dwPXtu+C2wAQuD4USOLt4JWPYpqzDfHYJIND/497P9Z9SuQeahr2ez3DRB g3qsHEjBV7QyU3RlcGhlbiBGYXJyZWxsICgyMDE3KSA8c3RlcGhlbi5mYXJyZWxs QGNzLnRjZC5pZT6JAkAEEwEIACoCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwEC HgECF4AFAlo+o3cCGQEACgkQWrL68XsXK+qO0A//ZsfQzyXrZlu/eEV5jU620yeO M3P7SW3C3UQYdCgZ/TlvxGgKow5oDSXgjMiUyq9csGqbPBxlDYSxFZHNeDVKYIuP 2ZK24tw5k6duTh4+sFwUualTMlcp0zBCIzn3hRcsRvuPKHfl5+6oOi0+xqx3jX/s /69L/fvHmdSKet5LIUAxoYaZkTCruFrPWb01tgAl5JExWkhmCY98iD+EeiIMAWBj Mw1xV+p0uCwNbN6XDzcToK7wsm+tAIiWUy3DpP60a6WbVwdV0HNt2WZq5U5Jdh2k 4S+sN2CnYk4tTW7jHjsWarV3FLISCOObADZuB7ljU4kYfdwZ+WzenXY4LGlxGQSl AblGjwZe4EIkCXAJUtzJhoFUuGaF/PlWjxqV3UFRcgTERZTijguVyREre8GNERNg vDxZvuXssEjvz9X5JfcIZDIJpdzhLiEIj9noUbfx1SzB5KDPQj0O7elMHa1671/r wWcpGr/MfVPTOik4H7F8rcVJelceZTzC4tvya7M+jM4fyFWWt8Y4atTixUiP7U9o 4uBZCQ0GzvsmFA4XLqn2pA5rVizMXnGbGOjufAP/efEJ4ul3qvjYe8ye8DXEDjKA xo/tuHYtk19XCi83QzFhWls5TT+XQeVTMEvVqo9Wek8yoxo67qvLKKqIcG9givQd 8MxYNAbNYgSPtkbhZ8SJARwEEAEIAAYFAlo9UqAACgkQLzyHNoBfjaLzHAgAlWT6 NXEGtw/r1miKNGcopzvzILQ9oB8rKI9U9EL6tOf/y2V5oYee/GyQDb3ZdoPxxYYc Jf+RyiH1nMoqUIZiZJaf3bJXinDZ5+AdfE++UR2NBvqaNyC6u3r24jo1B/sagKbY tWgsYtRqHLD4IWi37MZrVyjBuF7u14Q07+uhjq6mX2O/tHpCYw/Q82tbeTRPyUf1 WQOAfD1kfBpW9PvAva5Iw9FWeXpCXRzwxnCZhYfGfqtuSw6CPBYLdbikqML6FZ7E DuTBb/8um1wK7Y9bgeIQC+CYjhYB5RXa1tDJRab2Js4luCvSR0w/CgHw26293tlv e2Q6UTrmHxP5U22DlokCPQQTAQgAJwUCWj1QMgIbAwUJCZQmAAULCQgHAgYVCAkK CwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6tJpD/4rrILH+meP07vrx8wW5eYuqCiP GYnh/CXxIF8eLrfbe5d4QRgtq+w6UeQPMyzKRIRiCoBXB2oJLBZHyxBPxZlg33dT MrEGn8QWKx2iNuz9rZMXyOSWFetuO01d/aUPd5BnbLbIyK5of8xCQlXM6KH8bc+9 gQ7edR9mfLTdvBf2FR522hg8BRBM1imKc3vO8v39+qIHHRjuiwxBBCAOhHtHRsZX ripS0uFA07dM46Oi/E8osjx6fQt/lH5z/PN+2adxYSrLSAXfr1oD3RxYNhuWgyGF L64/VCQb1YGjf0Z5MBPnWm9jgUoOY5K9eNSS0L83WeJjlF5+Q/WOgB+rb49Prm2D Feo9+S9f2V53Llz1WIspXJg6f+n9lmHE94MfQj1GAHCzI0FeL19lvM+LhD8jJSCb hrC3+yobyy/AUOs5Z3E+njjX1FF/VCVAs6iOa6i+XG+Y1hh3ir2y1kckJ5auT10M SU8GEZu9ayU4M3o3N9yxOjaoP0NuQ4MMLL/n/u4u94AeZaHPNBXn/hVfVRRmpRXt GKvJtFAEppGEYezB+bLKIm6XlpPkhnwYzleLZ7AMEco2C6QM8QPB3g3JpS3sqRhA 5rEP4lL16BmijmF+CHoPE/zwgKZbKpyVDqvIW5IDgvfIC2X4pbZDRvGIUKaGSB4+ ksZgUUnNyvfQr2p7jokCMwQQAQgAHRYhBH4XCgRchM9GDit5oBDvedn9g1MSBQJb tySbAAoJEBDvedn9g1MSeKkQAJm44jt1kwHgQgeDBKdjdvl0AjE0xVEQxriZ6lP/ l//34YT0auFfzsYIrChSpQXAEtobBAr4Ohw1Us+BZe+H5P8vm6LRuPwozC3SjwfX 4Iec8+9ot6tIVg4sbedDSgb/CCFVjsmIGcQ1P73JLJTBJ6mxYCV/gn3QC6bwDOFo 7kD9FDHCjRN8XfhHQ4Q9cYyt06uF31qG/aumgWYC9geCGgAwiHgwxNYb9GoJ0iZj CROwbYvLTcQgsVUW2bTmsVR13UVKDsdl02sRV7qcVYW6R0a3Ra8KudX+nt25H5DR Gd382KZ5W8pydsy/viTvD9z6v0ulChBYxAedIvGIClrhbxlLEPmIg4ImVOLGqsUg Vm32J95WOjEkk4PEZ12xSDBtwhSJqmJNboWlfmw43KdIbY8zNhffIO3N6O7FsdGx mqyHeLoTpqY+ySVUPpbuyW8ujnI/J//+6hdTZ9dQsEJQlWngKuWOQ5ma58MPSN88 zllsqhZAFQjNxqnkSzL6ZQ+v/jvuRRe16B80AeO55DsmbWsMv/YLLD1mSi7+Khy2 EtMBhgojWwrGMvdLN6X3mnzNJEscYyLxM9tSk+iySP2sLthK0BVgpAzBSdaf/ezI z60P+neHDzteNFf8Mn7lmgYk1amvZoJ29s5+n2HwxyRL5dVMyMdyQmntubbctfqr Z0tIiQGcBBABCgAGBQJbxcflAAoJEGo7ETk8pK1gnCYMAJY4FeIYjlIXGghFWzsB 4fYwK1+iaFpU3fSto5qcrqVtVPjXpwqczqBWeXGyQxiB0kan4OVAXydIeaP8EAuF CA7paP3s9STLJBO3KurkwyRkPW5zo0X7xVqaVToRsX2Ul98KVJoHYQD1KdezEtwl vpNwiiBr42AYR751Vm6JBVAbQXuFpB3c8bUV0OkkRxNFtL8/2PieHar58n5dntGk bPlPkztahsFqktgacIgXHX5vaT+7YeeZ1DWLOYjGO0wNhkOSeroCmxwJUikU7joB p823L7r5KfpqWTPpSCzVstQKZUGmmoE1qCswY/Ud5wvp9SccpIILkRXj0rZRtfnE 5MpL3hjmtNzfDd9qIsJtBJlSB2hZwAsVm1l+EWN9hG3tqyA43niUMy2n6q690of3 berSiQ+kvY/aC9Hx8I+bKzOV9/J2VUTqfaPZa4Uy2rVX5Q2p69n/PMj7mEer0rCL 3j9V16J9c+s0BSkXoKdtYdB0TWVhBgUybd9qtYcwHWvhP7QuU3RlcGhlbiBGYXJy ZWxsIDxzdGVwaGVuQHRvbGVyYW50bmV0d29ya3MuY29tPokCPQQTAQgAJwUCWj1R WgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6jsc EADEcB0WQEZn2AkrzDs1RhL0Lp6cZi0BigofkbcGfdhJyMSs19C0dhvncrAFClVI 6/Udw3yFtDyYtOCf2W3M3A1K6/RfEizCLzTsdFIhni9gOJLlUpXViQtgrlstjk7h qVV3Ooz4BlCqS4cG7rfqf4LQQPpTAuFUEV9I28FBUB2irqC+v4gTysIgpMw0bA1y BU9sX5jE/tRkzqnuzZrkwiobDtRFJ9qp+7O2JtcY4EsVtLAsaodJKc5cF8R4OvB1 n66vxxcgg9Eh4JNWZ47xsaCmAGo1Bcb2jIY35OtgAL7gCGLRSMKTtAaPy1/fEgIq hCljJ9x40Fkn/3r2BX21WC9HFSPFTBz2RluLRzxdgxOrkYK8EiHUPoE5b1AEzZKw 2AbeXfr57f5zYsN3IqfbQLUjMYtUN1wK3Pjb+idD972wyXMWt8uOzlI7b9Ocu+nY m2whBfJv9Pmp3QYTmPz+LB9lH65VNVUSxSXVr5iWXO3qx1HtEiGEqkporMQCTh3T 5Ud3PvMSRBFFKNs9WhJ/Lxz+SV30WLwG6dr5mQqlzAhb4Phc/zekZyXRdS/oDKrB LUucS36O//49JeyRi1QvOfxnfmIqRIAf/k3PoYJmTo5E82//r5Qj3YGlRu78ba0H Arxs+ACD6AnEHHcbswpbtVEKYzlSu0Ar0Dc7vRWM/IyQdIkBHAQQAQgABgUCWj1S oAAKCRAvPIc2gF+NosIsB/9f/29FNla3BJfGIEIDnhrqGD0i9bSa89SqBd++uG06 TQgW5wsqtNcrwn81yZTq6XE6i9VtD4GKfqC0d4KZJr9bnbeD81cI64VOdL8zJWJs 0vj5EIXCobKyX74Kb4uePUyZqwT2Q74I116u/HwA9/FXsPo5isbh4ZqD4t0VHpWk mfq1FPT9a/JPyX46qKqB2Fce/7Qy+SQP1NfkuUlbhUH/JG9aSSYvk3lznNiH41x9 M+FDlL106itXOubrl3oi2fT3fsSedq7uzt+IV0DQEeNaoQAUuwEhdB8IWOMqN2wo DjGVKJftfsSWY9ilZrnDBNDrp0vRqcx33LUMkIw4d7iBiQIzBBABCAAdFiEEfhcK BFyEz0YOK3mgEO952f2DUxIFAlu3JJwACgkQEO952f2DUxJjuw/6ApHSsVTWD4a0 H6FJ23A9Ftpy+aXZ4vYlzkSrfsn2ECrEfK3lXQh/uzwjJUDYZeB1/BQsFZtcYNQO JSSHbQ49BFRLwb1J/wBZG4bbmrkLxnNbKDKQvzxEpclkMW0Dj0J6o7kGrmzIGGrh B+JJN99AcineHRug8ZSFIERRCmigxdhAKU0BFD7P+5HNHltSL3DF1c2fFOf2JrgB KVoE+9RhMZjWNbYetFFLCkjXb5Rpay9zeMm1DxfSTGAnuOwUXW6qq4hnl5+VC/48 ceDZElLLfu7RQUZv44pkSTOWZs+iQoJiHMFHk9wPqyB2Vok1yJ2a2j27WhXrJlPw nZbgJO5RyWDG3p/eVmpl5Uuc2dsfIpR17KnAuWpghK6V+cyFncDoGCl/YG2Mvool sW08FiZh3Ej4dnJjj25TZkeFG74JJDXLvMYpJfSBGnmETv4Dhcm2xPqVMuFuL1qJ lMbVLrMo2GXeo03OzNyvbs+u8WLIaGm5hC7N1CXY8wZs4jo6OJ/expvnc07dEuws 4zT3AiWv3nIouWReRStZy9QkavDocqbyPmilcdPCYk4BsOlzpwwO74hNG7iyl0Kd AlwTxGQ7y0rJou6HYa1TmRhIEr3vKvlW+JfUUrqtjXgsuacTXo4+Ira2JUErL2cY zQMq1j4r1ZyhFnuz93s7Rsx/Nw0+0YuJAZwEEAEKAAYFAlvFx+UACgkQajsROTyk rWCJqwv+NLVPE4sD4sDA2/6Ek7UsRIUkg+S39fhqWsLc4rtw/mDunv8Un61I3K04 fZ2Ry4nF9hZM0a710UvXFbStvrzRJO3EAAcdJR9LTCd19e8UeruQbIee3YT91U4N kC9JMpecfq62/teOAU2e5P3fWYaLs5ZX7zCLwWuBcW2l3SyoljQczM85HhJ3XHm+ FnwQ6D9xRle+lvWTcuC9d1yAyUb8IOospcL2lJTmy8e3r79R24hPlSB4LDe0wEN8 AXbagrcAQZjwyaHyWxjJbTwZ0b43WGdfIqZ1ElOeoffbketPGRmWvx5xUvb2ALFB BdETzV270gs5XDJgJ1SIIKOyDADxwvroTe2jD8C/841eEql5QSow3s/U3zRqk3mt tto8Qw/DN71aeh6dmYSsvd2UjsHw/vofOPRBGxZLEkKTEvMnhmMW9hiKPkPia+Qg evYE020qpKSxLEdWA8nprHwxmGiDNesCfXSC6vm1qfyj5g8HzxSckq9ZaMhKMCo7 vxflUEDuuQINBFo9UDIBEAD6DdHQfMav8OXfhjTteoarOrlJTSdci727xiezGPuB HmpvceBRZgRasdbaMc4HJee+R9+5x/nLPCuy/DxDyIjwIUeJNgc+l7LjI9WfpHTD 8U4xxjvR5Mi7+ToQQUOUNuzT0O0pyuxP1uY3RehHEhOVfBZO59ipSeZL5iQC6T5M sK1SKfs51pLa5ToC1rc8tBJ4zZmxRAyZiYc/AH2uZ/6rYjTTkAn1DVI9DYo2D/zE 4bGjXdJW5pKphFB2lX3dG4I7ODi+5e1H6A/QpCu6z8/ZkIQ+9T1xcX/YwiFeA7Pb TuW/eITbMbI1eV3+fyym9aT7Rsflmp31Zxtr+sZwGGZf00ooMBFmqOS//NUQ/Vf3 vDUew1h5QU1yDaWT3NApvi+XWPH9TPy6TMfZA2FThHf11sX/gDBa5JWQZbptPEcm oazpiKZt91CrFPOaoXDPck/Q61dfmr/oPikfByYnASIM3OwEuXqyQ9JDRfKrem5r +oA/wxWb5jELElAhOpnyqMMvOh7uz1foUssL8MAv2TGXmxpVJ8Nu4je6wf96Z22f Q0D38zud+CKH3bMP3ayXXJBcdPoENrzFbWP5FTg/4TTDJ3vOAHZR5iCunYghx8b7 Ffa4UbkwlD+dh8GiIAtvT51Ac0cO0Wc0Zjc57zPUz1zloMbf+zb1Bsn7DuEQoqj1 gwARAQABiQIlBBgBCAAPBQJaPVAyAhsMBQkJlCYAAAoJEFqy+vF7FyvqrC8P/1tF 6TeR83xD6MasqXyrBjwcLmziaF0Mlkj8k/YUiZ/knb53n97xQnh9yxPv0TT8Wpfd n3BmvqGyh8+ouHX9jMOxiRkMdNhIauVYY/8jmRfBSYWcFkfMzdYasvdLtmYJgx25 2HKTFdeOrszoOjWjEzwmh+tca3AFMu/nB++/KAmi5UJV7zsZ7uYJ5jm97LV5SLjN JIXXM+lHqCDrjDaDhNczmq1LCRlU6/WDjvkuwaVhZG4lXxMDrvKnXMkjseQ2oKjw rIdfQM86H1z5J31lfhqop+of0cimcIsBgSCPu+h96LHuAzeRBCbDKeqrfZtAZAGs okRina9947fRWxXHh3O66ILmXKNRxxWbDkPvYnQWUat8SbSTDoPWrDIGDRIAypqY o3pcN2OE0C1chqgDZQxkr+9kYZQpupOAN2TR+fM7JvbO9coKI8Uqog8CopoMeDQk d0YjcqlB1E0svODHTzcSoRzogDBYDqNLP7qVkNXpcOAXSVioBgiSDf7o5RdS/qmU yXBIeq6I5z8xBcd+BQ/n/9Frkm6K7IKP3ngUP4wEoiPx5ZE5+fPIScGmVUcZIMhk vMvem9XXh1yyhqN14gfjmLwPGdWbrgG8QUe0s2WeWIyss6uTiyF+ZbJSo2XOKVc3 YFMVUUfgyudqAV1wWdZinUk+H3pkqOKoHAy/8fST =3DYzQY -----END PGP PUBLIC KEY BLOCK----- --------------52A715765E2CB93121294112-- --JmIcQx72sEyt9BGwnNBd0Lt0XXEwQk1i9-- --gVC2mNrf6QWQtskhS1eckXPiANeao359L Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEW7Wm6ldl0sWGPK4nWrL68XsXK+oFAl0WaPwACgkQWrL68XsX K+p01Q/+NFv2qmw48trKb9E1WLJrdwqZqBgi4n1yLQOkZHbqsB4IKRwXhzomQVxK VMOjRHg40dbGbIkwQE4HQtIFcwPyL5AHZYIC7J53So8mgd/hn4BRm9K/je/VUhFy ciwgz45yndr9DuyPzqcI8vA3fKaJTGOc2eT8ErkHQqLTvpFfcY2yi4JWko4hMzbQ iOgh2+VgECmyBdWtjkZCOpmO33lZ/GOWQaAgo2ygW+3sCZr9v0EFH4LlIItN8pNl 6A61sa+vQCzpRvCiuUsapW3pMg0cSXDig5ZMS2bH9vTnTFRLNZ7QC1k9sV4XxLBo 4WtvBR17h4WxNxNR5LZzWWU7FK/1HSbr0R8UbhGgBQ4KZS5cJMydJOA80OyUeKNm MzWPapPtdDG8dCl7W3mE7L/37YA5ml+cdxQVLkJ/XXer/8F/3s/5PiZXx0OCAe0/ igI5WSCo6ezPaTMj+YmzE5iBGTK9bIhTWvmYcDsnlRJ3utjBnFzFsTF65XUWwbGL VQlQdbMEGAVaFOJoPwWZori8n8LFt15vflZVbarHzyxMu4RFTde8LOt7Ok2zEAGt 8xjpQoyI/9xMk+s/cvhmHs8D6M8bCUkRIYD4nOtmNu6pPDW22x00gTR/hG3j2Tp0 VJyCPuFVa8ZpaukLuJAaGSwA9IhDBRp6ahaa4a3B0pMjVGCWcEI= =7cGJ -----END PGP SIGNATURE----- --gVC2mNrf6QWQtskhS1eckXPiANeao359L-- From nobody Fri Jun 28 16:04:14 2019 Return-Path: X-Original-To: tls@ietf.org Delivered-To: tls@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 3D8031209D7; Fri, 28 Jun 2019 15:58:05 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: "\"IETF Secretariat\"" To: , Cc: tls@ietf.org, kaduk@mit.edu X-Test-IDTracker: no X-IETF-IDTracker: 6.98.1 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <156176268524.11015.1547163313876553775.idtracker@ietfa.amsl.com> Date: Fri, 28 Jun 2019 15:58:05 -0700 Archived-At: Subject: [TLS] tls - Requested sessions have been scheduled for IETF 105 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 28 Jun 2019 23:00:06 -0000 Dear Joseph Salowey, The session(s) that you have requested have been scheduled. Below is the scheduled session information followed by the original request. tls Session 1 (1:00 requested) Tuesday, 23 July 2019, Afternoon Session III 1710-1810 Room Name: Place du Canada size: 300 --------------------------------------------- tls Session 2 (2:00 requested) Thursday, 25 July 2019, Morning Session I 1000-1200 Room Name: Place du Canada size: 300 --------------------------------------------- iCalendar: https://datatracker.ietf.org/meeting/105/sessions/tls.ics Request Information: --------------------------------------------------------- Working Group Name: Transport Layer Security Area Name: Security Area Session Requester: Joseph Salowey Number of Sessions: 2 Length of Session(s): 2 Hours, 1 Hour Number of Attendees: 120 Conflicts to Avoid: First Priority: teep taps suit secdispatch saag stir rtcweb quic perc mls httpbis dnsop tokbind dispatch curdle cfrg acme uta git Second Priority: dprive ace Third Priority: tcpinc lamps sidrops People who must be present: Eric Rescorla Rich Salz Sean Turner Joseph A. Salowey Yoav Nir Benjamin Kaduk Christopher A. Wood Nick Sullivan Resources Requested: Special Requests: --------------------------------------------------------- From nobody Sat Jun 29 00:17:03 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 133B4120969; Sat, 29 Jun 2019 00:17:01 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.926 X-Spam-Level: X-Spam-Status: No, score=-3.926 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DEAR_SOMETHING=1.973, HK_RANDOM_ENVFROM=0.001, HK_RANDOM_FROM=0.999, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bqJ2cbVUo2mT; Sat, 29 Jun 2019 00:16:57 -0700 (PDT) Received: from itu3out.svc.unicc.org (itu3out.svc.unicc.org [206.155.102.66]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 46A621200E6; Sat, 29 Jun 2019 00:16:56 -0700 (PDT) Received: from TUCM04.TUECSP.UNICC.ORG (unknown [10.81.38.71]) (using TLSv1.2 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) by iccpfxor03.svc.unicc.org (Postfix) with ESMTPS id 6A5C84000F; Sat, 29 Jun 2019 07:16:54 +0000 (UTC) Received: from TUCM02.TUECSP.UNICC.ORG (10.81.6.71) by TUCM04.TUECSP.UNICC.ORG (10.81.38.71) with Microsoft SMTP Server (TLS) id 15.0.1395.4; Sat, 29 Jun 2019 07:16:53 +0000 Received: from TUCM02.TUECSP.UNICC.ORG ([10.81.6.71]) by TUCM02.TUECSP.UNICC.ORG ([10.81.6.71]) with mapi id 15.00.1395.000; Sat, 29 Jun 2019 07:16:53 +0000 From: "Yang, Xiaoya" To: Liaison Statement Management Tool , "TSB SG17 Secretariat, ITU" CC: Transport Layer Security Discussion List , "christopherwood07@gmail.com" , Scott Mansfield , "BenjaminKadukkaduk@mit.edu" , Sean Turner , "Benjamin Kaduk" , Christopher Wood , Joseph Salowey , Roman Danyliw , "itu-t-liaison@iab.org" , "EricResorlaekr@rtfm.com" Thread-Topic: New Liaison Statement, "Liaison to SG17" Thread-Index: AQHVLfoaQv78uXCe7EiOmRLIMf9cgqayOUxV Date: Sat, 29 Jun 2019 07:16:53 +0000 Message-ID: <0867b98372a844029fb18d576ccdef73@TUCM02.TUECSP.UNICC.ORG> References: <156175802534.21827.16669590454627867637.idtracker@ietfa.amsl.com> In-Reply-To: <156175802534.21827.16669590454627867637.idtracker@ietfa.amsl.com> Accept-Language: en-GB, en-US Content-Language: en-GB X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted Content-Type: multipart/alternative; boundary="_000_0867b98372a844029fb18d576ccdef73TUCM02TUECSPUNICCORG_" MIME-Version: 1.0 Archived-At: Subject: Re: [TLS] New Liaison Statement, "Liaison to SG17" X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 29 Jun 2019 07:17:01 -0000 --_000_0867b98372a844029fb18d576ccdef73TUCM02TUECSPUNICCORG_ Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable Dear Sir/Madame, This IETF liaison is received by SG17 with appreciation. Sent from my Samsung Galaxy smartphone. -------- Original message -------- From: Liaison Statement Management Tool Date: 6/28/19 23:40 (GMT+01:00) To: "TSB SG17 Secretariat, ITU" Cc: Transport Layer Security Discussion List , "Yang, Xiaoya"= , christopherwood07@gmail.com, Scott Mansfield , BenjaminKadukkaduk@mit.edu, Sean Turner , Benjamin Kaduk , Christopher Wood , Joseph Salowey , Roman Danyliw , = joe@salowey.net, itu-t-liaison@iab.org, sean+ietf@sn3rd.com, EricResorlaekr= @rtfm.com Subject: New Liaison Statement, "Liaison to SG17" Title: Liaison to SG17 Submission Date: 2019-06-28 URL of the IETF Web page: https://datatracker.ietf.org/liaison/1647/ From: Christopher Wood To: tsbsg17@itu.int Cc: Transport Layer Security Discussion List ,Scott Mansfield= ,Sean Turner ,Benjamin = Kaduk ,Christopher Wood ,Joseph Salowey= ,Roman Danyliw ,itu-t-liaison@iab.org,xiaoy= a.yang@itu.int,Benjamin Kaduk kaduk@mit.edu,Eric Resorla ekr@rtfm.com Response Contacts: Christopher Wood ,Joseph Salowey ,Sean Turner Technical Contacts: christopherwood07@gmail.com, joe@salowey.net , sean+iet= f@sn3rd.com Purpose: For information Referenced liaison: LS on SG17 work item X.ibc-iot: Security framework for = using Identity Based Cryptography for IoT services over telecom networks (h= ttps://datatracker.ietf.org/liaison/1629/) Body: Thank you for the LS concerning SG17=92s work item X.ibc-iot [1]. As= you are no doubt aware, the TLS WG and the IANA TLS Designated Experts wor= ked with the X.ibc-iot authors, who also are authors of draft-wang-tls-raw-= public-key-with-ibc [2], to register four TLS Signature Schemes: eccsi_sha2= 56, ibs1_sha256, ibs2_sha256, sm9_ibs_sm3. These values can be found in th= e IANA TLS Signature Scheme registry [3]. We would like to thank those authors for working through the IETF process b= y 1) modifying their draft to add ibs1_sha256, ibs2_sha256, and sm9_ibs_sm3= so that all of the requested values from X.ibc-iot were included, 2) prese= nting their draft to the TLS WG at IETF 104, 3) resolving comments from the= WG and the Designated Experts, and 4) for their patience throughout this p= rocess. [1] https://datatracker.ietf.org/liaison/1629/ [2] https://datatracker.ietf.org/doc/draft-wang-tls-raw-public-key-with-ibc= / [3] https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tl= s-signaturescheme Attachments: No document has been attached --_000_0867b98372a844029fb18d576ccdef73TUCM02TUECSPUNICCORG_ Content-Type: text/html; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable
Dear Sir/Madame, 

This IETF liaison is received by SG17 with appreciation. 




Sent from my Samsu= ng Galaxy smartphone.


-------- Original message --------
From: Liaison Statement Management Tool <statements@ietf.org>
Date: 6/28/19 23:40 (GMT+01:00)
To: "TSB SG17 Secretariat, ITU" <tsbsg17@itu.int>
Cc: Transport Layer Security Discussion List <tls@ietf.org>, &qu= ot;Yang, Xiaoya" <xiaoya.yang@itu.int>, christopherwood07@gmail.= com, Scott Mansfield <Scott.Mansfield@Ericsson.com>, BenjaminKadukkad= uk@mit.edu, Sean Turner <sean+ietf@sn3rd.com>, Benjamin Kaduk <kaduk@mit.edu>, Christopher Wood <caw@heapingbits.net>, Josep= h Salowey <joe@salowey.net>, Roman Danyliw <rdd@cert.org>, joe@= salowey.net, itu-t-liaison@iab.org, sean+ietf@sn3rd.com, EricResorlaekr= @rtfm.com
Subject: New Liaison Statement, "Liaison to SG17"

Title: Liaison to SG17
Submission Date: 2019-06-28
URL of the IETF Web page: https://datatracker.ietf.org/liaison/1647/

From: Christopher Wood <christopherwood07@gmail.com>
To: tsbsg17@itu.int
Cc: Transport Layer Security Discussion List <tls@ietf.org>,Scott Man= sfield <Scott.Mansfield@Ericsson.com>,Sean Turner <sean+ietf@s= n3rd.com>,Benjamin Kaduk <kaduk@mit.edu>,Christopher Wood <caw@= heapingbits.net>,Joseph Salowey <joe@salowey.net>,Roman Danyliw <rdd@cert.org>,itu-t-liaison@iab.org,xiaoya.yang@itu.int,Benjamin Ka= duk kaduk@mit.edu,Eric Resorla ekr@rtfm.com
Response Contacts: Christopher Wood <caw@heapingbits.net>,Joseph Salo= wey <joe@salowey.net>,Sean Turner <sean+ietf@sn3rd.com>
Technical Contacts: christopherwood07@gmail.com, joe@salowey.net , sean+= ;ietf@sn3rd.com
Purpose: For information

Referenced liaison: LS on SG17 work item X.ibc-iot: Security framework for = using Identity Based Cryptography for IoT services over telecom networks (<= a href=3D"https://datatracker.ietf.org/liaison/1629/">https://datatracker.i= etf.org/liaison/1629/)

Body: Thank you for the LS concerning SG17=92s work item X.ibc-iot [1].&nbs= p; As you are no doubt aware, the TLS WG and the IANA TLS Designated Expert= s worked with the X.ibc-iot authors, who also are authors of draft-wang-tls= -raw-public-key-with-ibc [2], to register four TLS Signature Schemes: eccsi_sha256, ibs1_sha256, ibs2_sha256, sm9_ib= s_sm3.  These values can be found in the IANA TLS Signature Scheme reg= istry [3].

 

We would like to thank those authors for working through the IETF process b= y 1) modifying their draft to add ibs1_sha256, ibs2_sha256, and sm9_ibs_sm3= so that all of the requested values from X.ibc-iot were included, 2) prese= nting their draft to the TLS WG at IETF 104, 3) resolving comments from the WG and the Designated Experts,= and 4) for their patience throughout this process.

 

[1] https://datatrac= ker.ietf.org/liaison/1629/

[2] https://datatracker.ietf.org/doc/draft-wang-tls-raw-public-key-with-ibc/

[3] https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-si= gnaturescheme
Attachments:

No document has been attached

 --_000_0867b98372a844029fb18d576ccdef73TUCM02TUECSPUNICCORG_-- From nobody Sat Jun 29 05:37:38 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 468511200DB for ; Sat, 29 Jun 2019 05:37:37 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.934 X-Spam-Level: X-Spam-Status: No, score=-1.934 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_SOFTFAIL=0.665] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TO02aMgVjzS1 for ; Sat, 29 Jun 2019 05:37:36 -0700 (PDT) Received: from mx0b-000c2a01.pphosted.com (mx0b-000c2a01.pphosted.com [148.163.155.36]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DF15F1200CE for ; Sat, 29 Jun 2019 05:37:35 -0700 (PDT) Received: from pps.filterd (m0128480.ppops.net [127.0.0.1]) by mx0b-000c2a01.pphosted.com (8.16.0.42/8.16.0.42) with SMTP id x5TCYDUV020230 for ; Sat, 29 Jun 2019 08:37:32 -0400 Received: from hound.seas.upenn.edu (coyote.seas.upenn.edu [158.130.71.130]) by mx0b-000c2a01.pphosted.com with ESMTP id 2te27tgrby-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Sat, 29 Jun 2019 08:37:32 -0400 Received: from mail-io1-f54.google.com (mail-io1-f54.google.com [209.85.166.54]) (authenticated bits=0) by hound.seas.upenn.edu (8.15.2/8.15.2) with ESMTPSA id x5TCbUsI020006 (version=TLSv1.2 cipher=AES256-GCM-SHA384 bits=256 verify=NOT) for ; Sat, 29 Jun 2019 08:37:31 -0400 Received: by mail-io1-f54.google.com with SMTP id k20so18340328ios.10 for ; Sat, 29 Jun 2019 05:37:31 -0700 (PDT) X-Gm-Message-State: APjAAAXjhiTerF5dKuKOg12aGQd5sYcJ8TQeRnQ9g71J4y8dt2sWd4co dff61VQ2SJF8Z2th5SIiOJTRyovTXHzNUFxLrZLw X-Google-Smtp-Source: APXvYqyS5EEMjhqxTkFGPVj/0wLoho42d9GEGp3fcejl/2UfMbpUmNjJUyRW7AgH5dK7UDCVaps9x6AqZSAZZU2PkgE= X-Received: by 2002:a5e:a708:: with SMTP id b8mr7560183iod.25.1561811845699; Sat, 29 Jun 2019 05:37:25 -0700 (PDT) MIME-Version: 1.0 References: <20190628080054.GA2408377@LK-Perkele-VII> In-Reply-To: <20190628080054.GA2408377@LK-Perkele-VII> From: Yishuai Li Date: Sat, 29 Jun 2019 08:36:49 -0400 X-Gmail-Original-Message-ID: Message-ID: To: Ilari Liusvaara Cc: tls@ietf.org Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:5.22.84,1.0.8 definitions=2019-06-29_10:2019-06-25,2019-06-29 signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 mlxscore=0 impostorscore=0 mlxlogscore=924 priorityscore=1501 clxscore=1015 spamscore=0 bulkscore=0 lowpriorityscore=0 malwarescore=0 phishscore=0 adultscore=0 suspectscore=1 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-1904300001 definitions=main-1906290159 Archived-At: Subject: Re: [TLS] Inconsistent TLSCiphertext definition X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 29 Jun 2019 12:37:37 -0000 Thanks Ilari. Ilari Liusvaara =E4=BA=8E2019=E5=B9=B46=E6=9C=88= 28=E6=97=A5=E5=91=A8=E4=BA=94 =E4=B8=8A=E5=8D=884:01=E5=86=99=E9=81=93=EF= =BC=9A > 1) 0x16 byte is appended to plaintext to yield TLSInnerPlaintext > (since this is encrypted handshake message), together with 0 > trailing zeroes (for padding, there could be more). 1. Is it worth adding this explanation to RFC 8448? Neither "TLSInnerPlaintext" or "0x16" was mentioned in the context, making this "Informational" RFC not so informative. 2. Is there a specific reason to structure TLSInnerPlaintext this way? Does it make parsing counterintuitive that the parser must know ContentType before locating ContentType? -Yishuai From nobody Sat Jun 29 07:41:36 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8AEEB12000E for ; Sat, 29 Jun 2019 07:41:33 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.598 X-Spam-Level: X-Spam-Status: No, score=-2.598 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xumch7oYEgVe for ; Sat, 29 Jun 2019 07:41:31 -0700 (PDT) Received: from welho-filter4.welho.com (welho-filter4.welho.com [83.102.41.26]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 147C9120041 for ; Sat, 29 Jun 2019 07:41:30 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by welho-filter4.welho.com (Postfix) with ESMTP id EA14245520; Sat, 29 Jun 2019 17:41:27 +0300 (EEST) X-Virus-Scanned: Debian amavisd-new at pp.htv.fi Received: from welho-smtp1.welho.com ([IPv6:::ffff:83.102.41.84]) by localhost (welho-filter4.welho.com [::ffff:83.102.41.26]) (amavisd-new, port 10024) with ESMTP id Tm-usGZu9Y_D; Sat, 29 Jun 2019 17:41:27 +0300 (EEST) Received: from LK-Perkele-VII (87-100-246-37.bb.dnainternet.fi [87.100.246.37]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by welho-smtp1.welho.com (Postfix) with ESMTPSA id 33C607A; Sat, 29 Jun 2019 17:41:24 +0300 (EEST) Date: Sat, 29 Jun 2019 17:41:24 +0300 From: Ilari Liusvaara To: Yishuai Li Cc: tls@ietf.org Message-ID: <20190629144124.GA2471630@LK-Perkele-VII> References: <20190628080054.GA2408377@LK-Perkele-VII> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: User-Agent: Mutt/1.10.1 (2018-07-13) Sender: ilariliusvaara@welho.com Archived-At: Subject: Re: [TLS] Inconsistent TLSCiphertext definition X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 29 Jun 2019 14:41:34 -0000 On Sat, Jun 29, 2019 at 08:36:49AM -0400, Yishuai Li wrote: > Thanks Ilari. > > Ilari Liusvaara 于2019年6月28日周五 上午4:01写道： > > 1) 0x16 byte is appended to plaintext to yield TLSInnerPlaintext > > (since this is encrypted handshake message), together with 0 > > trailing zeroes (for padding, there could be more). > > 1. Is it worth adding this explanation to RFC 8448? Neither > "TLSInnerPlaintext" or "0x16" was mentioned in the context, making > this "Informational" RFC not so informative. Well, the RFC 8448 does not cosider how the record protection works internally. > 2. Is there a specific reason to structure TLSInnerPlaintext this way? > Does it make parsing counterintuitive that the parser must know > ContentType before locating ContentType? Yes, to encrypt the content type of encrypted records and offer to pad them with no extra overhead (there is no padding length field). It was not possible to encrypt the main content type field due to the fact that the range is not bit-aligned. Parsing should not be that difficult: - If outer content type is 21, it is unencrypted alert, if 22 it is unencrypted handshake fragment and if 23, it is encrypted record, that one should attempt to decrypt. If this fails, send fatal alert. - For unencrypted records, payload starts at byte 5 of the record and extends to the end. - For encrypted records, After decrypting, scan for last nonzero byte. If none is found, send fatal alert. - The last nonzero byte is true content type. - The part of decrypt output before that last nonzero byte is the record payload. -Ilari From nobody Sun Jun 30 20:36:16 2019 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D7D431201F8 for ; Sun, 30 Jun 2019 20:36:14 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.701 X-Spam-Level: X-Spam-Status: No, score=-2.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=lowentropy.net header.b=MEy/+7mv; dkim=pass (2048-bit key) header.d=messagingengine.com header.b=m40ZH6nU Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MrKnWsiKtanm for ; Sun, 30 Jun 2019 20:36:12 -0700 (PDT) Received: from wout4-smtp.messagingengine.com (wout4-smtp.messagingengine.com [64.147.123.20]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8EA8112019D for ; Sun, 30 Jun 2019 20:36:12 -0700 (PDT) Received: from compute1.internal (compute1.nyi.internal [10.202.2.41]) by mailout.west.internal (Postfix) with ESMTP id A8B6F34B for ; Sun, 30 Jun 2019 23:36:11 -0400 (EDT) Received: from imap2 ([10.202.2.52]) by compute1.internal (MEProxy); Sun, 30 Jun 2019 23:36:11 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=lowentropy.net; h=mime-version:message-id:in-reply-to:references:date:from:to :subject:content-type; s=fm2; bh=HEDrVoCxIv+rJTTxc+4erqjkCMGC+O2 lxy9XPqP2bS4=; b=MEy/+7mvJwmjorvTylwuaoLhmOCosKKNbNuCw4esocuPFSn /w8VX7uj/Oj+2j5yrOilAwo2UnSkzTanlGVLuLZNJpsVkPNzrEvvFSyoM4jafqaO L4nZNB699K+WWOPx/F0NfGCpWUIcY6Z4dcAQt9ITd4a3fMrSCN6q5kvUA062Dj9o mAPVHk174brIlMBJJ66sKpxuJ5npqdeSocWGHcUW84LfnY1lWW0fudg4Ss7yQNyJ 22AMF1ez/a0sukyqVHzo5B07juWnDCpp6t3m4/vhUIDlSSF5RCviXFZ6aoxalHhu c03AmMkMn0/634Xd/mwqUGBhhq5aFEiGloSenIw== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to:x-me-proxy :x-me-proxy:x-me-sender:x-me-sender:x-sasl-enc; s=fm3; bh=HEDrVo CxIv+rJTTxc+4erqjkCMGC+O2lxy9XPqP2bS4=; b=m40ZH6nUril7E/mbU9vNl1 53AeSLT4zMqgzpIAUJ6QnxYi11rfQ5PtmeI7TM1YwWNuhs+XKuA4xkgTCsw4KogB sL6VIHI/Sot8tY7KLpQmiim2pLbyT+qZoSJWsWOJWtHi36YwIqS/haK1LrWg7SkC qFtxIWyXfX4GAlQO+RDI7A7ZorvWF4Nga2v4FLzudwBwzx2mvvgq4/eSSsO+3tQ0 gr92jjmyqQSpbJX/8m+YHK/qSZp/Uja80Qb3zWka+JaoYr9G1HZlsrbZIgNpXRLn B9vaDpeM89IgQnmQ1l7Fr7lPq3y8yivbE/eyuTyLfdiFQmylNmRYt1+tDbGODG5Q == X-ME-Sender: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgeduvddrvdehgdejfecutefuodetggdotefrodftvf curfhrohhfihhlvgemucfhrghsthforghilhdpqfgfvfdpuffrtefokffrpgfnqfghnecu uegrihhlohhuthemuceftddtnecunecujfgurhepofgfggfkjghffffhvffutgesthdtre dtreerjeenucfhrhhomhepfdforghrthhinhcuvfhhohhmshhonhdfuceomhhtsehlohif vghnthhrohhphidrnhgvtheqnecuffhomhgrihhnpehivghtfhdrohhrghenucfrrghrrg hmpehmrghilhhfrhhomhepmhhtsehlohifvghnthhrohhphidrnhgvthenucevlhhushht vghrufhiiigvpedt X-ME-Proxy: Received: by mailuser.nyi.internal (Postfix, from userid 501) id 9DF79E00A2; Sun, 30 Jun 2019 23:36:10 -0400 (EDT) X-Mailer: MessagingEngine.com Webmail Interface User-Agent: Cyrus-JMAP/3.1.6-731-g19d3b16-fmstable-20190627v1 Mime-Version: 1.0 Message-Id: In-Reply-To: References: <156173339678.20700.10472293883370612968.idtracker@ietfa.amsl.com> Date: Mon, 01 Jul 2019 13:36:13 +1000 From: "Martin Thomson" To: tls@ietf.org Content-Type: text/plain Archived-At: Subject: Re: [TLS] =?utf-8?q?Fwd=3A_New_Version_Notification_for_draft-schwar?= =?utf-8?q?tz-tls-lb-00=2Etxt?= X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 01 Jul 2019 03:36:15 -0000 You might like to coordinate with Martin Duke, who is doing similar (but different) things with QUIC: https://tools.ietf.org/html/draft-duke-quic-load-balancers-04 Personally, I find this sort of thing difficult to reason about. I would rather have a separate TLS connection with each backend than to overload or annotate connections. Cramming stuff ahead of the real connection is awkward, but I can see how that might be necessary in order to get back-end systems ready for the new connection. That won't be sufficient for QUIC though. As an aside, the proposed design for QUIC is a very good way to ossify the QUIC handshake. I don't think that's a good way to do this, even if I believed that the potential growth in MTU was not a problem. I would have thought it easier to use an exporter (plus one to provide a key identifier) to get shared keys -- if you need them. I don't think that you do though. If you look at Martin Duke's design, the load balancer acts as an oracle. It can do that for ESNI in the split mode you envisage. On Sat, Jun 29, 2019, at 02:52, Ben Schwartz wrote: > Hi TLS, > > This is a proposal for a very simple new protocol whose main purpose is > to enable ESNI "split mode". Ultimately, I hope that this protocol can > also enable more end-to-end TLS, by reducing the need for > load-balancers to terminate TLS. > > Please discuss. > > Thanks, > Ben Schwartz > > ---------- Forwarded message --------- > > A new version of I-D, draft-schwartz-tls-lb-00.txt > has been successfully submitted by Benjamin M. Schwartz and posted to the > IETF repository. > > Name: draft-schwartz-tls-lb > Revision: 00 > Title: TLS Metadata for Load Balancers > Document date: 2019-06-28 > Group: Individual Submission > Pages: 8 > URL: https://www.ietf.org/internet-drafts/draft-schwartz-tls-lb-00.txt > Status: https://datatracker.ietf.org/doc/draft-schwartz-tls-lb/ > Htmlized: https://tools.ietf.org/html/draft-schwartz-tls-lb-00 > Htmlized: https://datatracker.ietf.org/doc/html/draft-schwartz-tls-lb > > > Abstract: > A load balancer that does not terminate TLS may wish to provide some > information to the backend server, in addition to forwarding TLS > data. This draft proposes a protocol between load balancers and > backends that enables secure, efficient delivery of TLS with > additional information. The need for such a protocol has recently > become apparent in the context of split mode ESNI. > > > > > Please note that it may take a couple of minutes from the time of submission > until the htmlized version and diff are available at tools.ietf.org. > > The IETF Secretariat > > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls > > Attachments: > * smime.p7s