[prev in list] [next in list] [prev in thread] [next in thread]
List: ietf-tls
Subject: Re: [TLS] Reminders
From: Anirudh Ramachandran <avr () fb ! com>
Date: 2016-07-11 22:27:52
Message-ID: 499E2873-99F1-47A9-A7B7-BCA529A1A3C0 () fb ! com
[Download RAW message or body]
[Attachment #2 (text/plain)]
On Mon, Jul 11, 2016 at 9:16 AM, David Benjamin \
<davidben@chromium.org<mailto:davidben@chromium.org>> wrote:
> OpenSSL determines which certificate to use during ClientHello processing, but it \
> has a mode where, if intermediates were not explicitly configured and only a leaf, \
> it path-builds right before sending the Certificate message. But I don't see any \
> reason why it can't be changed to compute this earlier.
Correct, OpenSSL's late computation of the chain, plus other design decisions \
(one-state-at-a-time, same buffer for everything, etc) is the reason I proposed the \
change. Since the draft requires cached-info to be the hash of the serialized chain \
rather than individual certs, it does require the serialization code to be run \
outside of the usual state machine codepath, which is also cumbersome.
The MAY instead of MUST makes the server-side implementation almost plug-in - \
serialization happens as normal and the serialized message is replaced if it matches \
a cached-info. The client side implementation only slightly more complicated - check \
first for a length match and then a cached-info match (needed anyway); if either \
fail, the client treats the message as a normal certificate.
Having another way to indicate this besides length would suffice too, but I'm fine \
with not changing the draft either if that's what everyone feels.
--
Anirudh
[Attachment #3 (text/html)]
<html xmlns:o="urn:schemas-microsoft-com:office:office" \
xmlns:w="urn:schemas-microsoft-com:office:word" \
xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" \
xmlns="http://www.w3.org/TR/REC-html40"> <head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Title" content="">
<meta name="Keywords" content="">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Arial;
panose-1:2 11 6 4 2 2 2 2 2 4;}
@font-face
{font-family:"Courier New";
panose-1:2 7 3 9 2 2 5 2 4 4;}
@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:"Cambria Math";
panose-1:0 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
{mso-style-priority:34;
margin-top:0in;
margin-right:0in;
margin-bottom:0in;
margin-left:.5in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman";}
span.hoenzb
{mso-style-name:hoenzb;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:Calibri;
color:windowtext;}
span.apple-converted-space
{mso-style-name:apple-converted-space;}
span.msoIns
{mso-style-type:export-only;
mso-style-name:"";
text-decoration:underline;
color:teal;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:737939110;
mso-list-type:hybrid;
mso-list-template-ids:808753374 -1894190582 67698691 67698693 67698689 67698691 \
67698693 67698689 67698691 67698693;} @list l0:level1
{mso-level-start-at:0;
mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Wingdings;
mso-fareast-font-family:"Times New Roman";
mso-bidi-font-family:Arial;
color:#222222;}
@list l0:level2
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:"Courier New";}
@list l0:level3
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Wingdings;}
@list l0:level4
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Symbol;}
@list l0:level5
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:"Courier New";}
@list l0:level6
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Wingdings;}
@list l0:level7
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Symbol;}
@list l0:level8
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:"Courier New";}
@list l0:level9
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Wingdings;}
@list l1
{mso-list-id:1145198611;
mso-list-type:hybrid;
mso-list-template-ids:97154854 -1669696682 67698691 67698693 67698689 67698691 \
67698693 67698689 67698691 67698693;} @list l1:level1
{mso-level-start-at:0;
mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:.25in;
text-indent:-.25in;
font-family:Wingdings;
mso-fareast-font-family:"Times New Roman";
mso-bidi-font-family:Arial;
color:#222222;}
@list l1:level2
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:.75in;
text-indent:-.25in;
font-family:"Courier New";}
@list l1:level3
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:1.25in;
text-indent:-.25in;
font-family:Wingdings;}
@list l1:level4
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:1.75in;
text-indent:-.25in;
font-family:Symbol;}
@list l1:level5
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:2.25in;
text-indent:-.25in;
font-family:"Courier New";}
@list l1:level6
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:2.75in;
text-indent:-.25in;
font-family:Wingdings;}
@list l1:level7
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:3.25in;
text-indent:-.25in;
font-family:Symbol;}
@list l1:level8
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:3.75in;
text-indent:-.25in;
font-family:"Courier New";}
@list l1:level9
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:4.25in;
text-indent:-.25in;
font-family:Wingdings;}
ol
{margin-bottom:0in;}
ul
{margin-bottom:0in;}
--></style>
</head>
<body bgcolor="white" lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span \
style="font-family:Arial;color:#222222;background:white">On Mon, Jul 11, 2016 at 9:16 \
AM, David Benjamin <<a href="mailto:davidben@chromium.org" \
target="_blank"><span \
style="color:#1155CC">davidben@chromium.org</span></a>> wrote:</span><span \
style="font-family:Arial;color:#222222"><o:p></o:p></span></p> <p \
class="MsoNormal"><span \
style="font-family:Arial;color:#222222"><o:p> </o:p></span></p> <p \
class="MsoNormal"><span style="font-family:Arial;color:#222222">> OpenSSL \
determines which certificate to use during ClientHello processing, but it has a mode \
where, if intermediates were not explicitly configured and only a leaf, it \
path-builds right before sending the Certificate message. But I don't see any reason \
why it can't be changed to compute this earlier.</span><o:p></o:p></p> <p \
class="MsoNormal" style="background:white"><span \
style="font-family:Arial;color:#222222"><o:p> </o:p></span></p> <p \
class="MsoNormal" style="background:white"><span \
style="font-family:Arial;color:#222222">Correct, OpenSSL's late computation of the \
chain, plus other design decisions (one-state-at-a-time, same buffer for everything, \
etc) is the reason I proposed the change. Since the draft requires cached-info to be \
the hash of the serialized chain rather than individual certs, it does require the \
serialization code to be run outside of the usual state machine codepath, which is \
also cumbersome.<o:p></o:p></span></p> <p class="MsoNormal" \
style="background:white"><span \
style="font-family:Arial;color:#222222"><o:p> </o:p></span></p> <p \
class="MsoNormal" style="background:white"><span \
style="font-family:Arial;color:#222222">The MAY instead of MUST makes the server-side \
implementation almost plug-in - serialization happens as normal and the serialized \
message is replaced if it matches a cached-info. The client side implementation only \
slightly more complicated - check first for a length match and then a cached-info \
match (needed anyway); if either fail, the client treats the message as a normal \
certificate.<o:p></o:p></span></p> <p class="MsoNormal" \
style="background:white"><span \
style="font-family:Arial;color:#222222"><o:p> </o:p></span></p> <p \
class="MsoNormal" style="background:white"><span \
style="font-family:Arial;color:#222222">Having another way to indicate this besides \
length would suffice too, but I'm fine with not changing the draft either if that's \
what everyone feels.<o:p></o:p></span></p> <p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">--</p>
<p class="MsoNormal">Anirudh<o:p></o:p></p>
</div>
</body>
</html>
[prev in list] [next in list] [prev in thread] [next in thread]
Configure |
About |
News |
Add a list |
Sponsored by KoreLogic