Re: [TLS] closing KeyUpdate

2016-09-10 Thread Eric Rescorla
PR Merged. -Ekr On Fri, Sep 9, 2016 at 11:07 AM, Sean Turner wrote: > The discussion about KeyUpdate-related changes has trailed off so it is > time to begin to bring the discussion to a close. It appears that there as > if there is support to land https://github.com/tlswg/tls13-spec/pull/61.

Re: [TLS] PR#625: Change alert requirements

2016-09-10 Thread Ilari Liusvaara
On Sat, Sep 10, 2016 at 08:43:33PM +1000, Martin Thomson wrote: > > I wouldn't say that this is a great argument, but it's one that could > be made. Generally, I've given up on TLS error codes being useful, or > even making them useful; we've been stung in the past by being overly > specific abou

Re: [TLS] PR#625: Change alert requirements

2016-09-10 Thread Martin Thomson
On 10 September 2016 at 00:35, Hannes Tschofenig wrote: > I personally would find it more useful to have an alert saying > "missing_server_name_extension" instead of just returning > "missing_extension" for a number of different extensions since this gives > the client no chance to fix the problem

Re: [TLS] Suspicious behaviour of TLS server implementations

2016-09-10 Thread Martin Thomson
I think that Martin (R) provided you with the answers I would have. Have you filed bugs against the servers in question for the issues that you have seen? On 10 September 2016 at 00:23, Andreas Walz wrote: > Dear all, > > we are working on an approach/framework for testing TLS implementations >

Re: [TLS] Zero-RTT Data & PSK

2016-09-10 Thread Martin Thomson
On 9 September 2016 at 23:37, Hannes Tschofenig wrote: > I am wondering why I cannot use Zero-RTT with just PSK-based authentication > (without a prior ticket change). I think that you would need to bind more things to the key in that case, but I assume that it would be OK if you did so. You alr

Re: [TLS] Finished stuffing

2016-09-10 Thread Ilari Liusvaara
On Fri, Sep 09, 2016 at 07:33:21PM -0400, Hugo Krawczyk wrote: > On Fri, Sep 9, 2016 at 4:22 AM, Ilari Liusvaara > wrote: > > ​I would much prefer to have two elements associated with such keys. One is > the key itself and the other is a binder (or whatever other name one > chooses for it) that c