Re: [TLS] PR#812: End Of Early Data as handshake

2016-12-12 Thread Eric Rescorla
On Mon, Dec 12, 2016 at 5:54 PM, David Benjamin wrote: > On Mon, Dec 12, 2016 at 8:45 PM Martin Thomson > wrote: > >> On 13 December 2016 at 12:43, Nick Harper wrote: >> > Right now, I believe it's legal for a client to send ClientHello, early >> > data, and end_of_early_data alert without read

Re: [TLS] PR#812: End Of Early Data as handshake

2016-12-12 Thread David Benjamin
On Mon, Dec 12, 2016 at 8:45 PM Martin Thomson wrote: > On 13 December 2016 at 12:43, Nick Harper wrote: > > Right now, I believe it's legal for a client to send ClientHello, early > > data, and end_of_early_data alert without reading any messages from the > > server. This change would require a

Re: [TLS] PR#812: End Of Early Data as handshake

2016-12-12 Thread Kazuho Oku
2016-12-13 10:45 GMT+09:00 Martin Thomson : > On 13 December 2016 at 12:43, Nick Harper wrote: >> Right now, I believe it's legal for a client to send ClientHello, early >> data, and end_of_early_data alert without reading any messages from the >> server. This change would require a client to wait

Re: [TLS] PR#812: End Of Early Data as handshake

2016-12-12 Thread Eric Rescorla
On Mon, Dec 12, 2016 at 5:45 PM, Martin Thomson wrote: > On 13 December 2016 at 12:43, Nick Harper wrote: > > Right now, I believe it's legal for a client to send ClientHello, early > > data, and end_of_early_data alert without reading any messages from the > > server. This change would require

Re: [TLS] PR#812: End Of Early Data as handshake

2016-12-12 Thread Martin Thomson
On 13 December 2016 at 12:43, Nick Harper wrote: > Right now, I believe it's legal for a client to send ClientHello, early > data, and end_of_early_data alert without reading any messages from the > server. This change would require a client to wait for the ServerHello > before sending (or not) En

Re: [TLS] PR#812: End Of Early Data as handshake

2016-12-12 Thread Nick Harper
On Mon, Dec 12, 2016 at 5:32 PM, Eric Rescorla wrote: > > > On Mon, Dec 12, 2016 at 5:23 PM, Martin Thomson > wrote: > >> On 13 December 2016 at 12:09, Eric Rescorla wrote: >> > David Benjamin pointed out to me that end_of_early_data is the only >> place >> > where we transition keys on an aler

Re: [TLS] PR#812: End Of Early Data as handshake

2016-12-12 Thread Eric Rescorla
On Mon, Dec 12, 2016 at 5:23 PM, Martin Thomson wrote: > On 13 December 2016 at 12:09, Eric Rescorla wrote: > > David Benjamin pointed out to me that end_of_early_data is the only place > > where we transition keys on an alert and this would be cleaner if it was > a > > handshake message. This P

Re: [TLS] PR#812: End Of Early Data as handshake

2016-12-12 Thread Martin Thomson
On 13 December 2016 at 12:09, Eric Rescorla wrote: > David Benjamin pointed out to me that end_of_early_data is the only place > where we transition keys on an alert and this would be cleaner if it was a > handshake message. This PR does that. It's encrypted under the same > keys, so this is large

Re: [TLS] PR#812: End Of Early Data as handshake

2016-12-12 Thread Benjamin Kaduk
On 12/12/2016 07:09 PM, Eric Rescorla wrote: > It's encrypted under the same > keys, so this is largely an aesthetic issue, but I think a good one. Agreed on both counts. -Ben ___ TLS mailing list TLS@ietf.org https://www.ietf.org/mailman/listinfo/tls

[TLS] PR#812: End Of Early Data as handshake

2016-12-12 Thread Eric Rescorla
https://github.com/tlswg/tls13-spec/pull/812 David Benjamin pointed out to me that end_of_early_data is the only place where we transition keys on an alert and this would be cleaner if it was a handshake message. This PR does that. It's encrypted under the same keys, so this is largely an aestheti