Re: [dns-privacy] DNS + 0-RTT

2016-04-09 Thread Daniel Kahn Gillmor
On Wed 2016-04-06 11:08:55 -0300, Colm MacCárthaigh wrote: > On Wed, Apr 6, 2016 at 6:03 AM, Daniel Kahn Gillmor > wrote: > > > forward secrecy > > --- > > > > IIUC for (b), the failing forward secrecy window is constrained by the > > duration of the

Re: [dns-privacy] DNS + 0-RTT

2016-04-06 Thread Colm MacCárthaigh
On Wed, Apr 6, 2016 at 6:03 AM, Daniel Kahn Gillmor wrote: > > forward secrecy > --- > > IIUC for (b), the failing forward secrecy window is constrained by the > duration of the PSK/session resumption ticket. That's doesn't seem > particularly worrisome to me

Re: [dns-privacy] DNS + 0-RTT

2016-04-06 Thread Daniel Kahn Gillmor
On Tue 2016-04-05 14:07:27 -0300, Tim Wicinski wrote: > As many of you are aware, with the TLS1.3 spec, there is some security > concerns around DNS+TLS1.3 0-RTT. dkg put together some threat models > and instead of forwarding some long thread, I figure I would put this >

[dns-privacy] DNS + 0-RTT

2016-04-05 Thread Tim Wicinski
As many of you are aware, with the TLS1.3 spec, there is some security concerns around DNS+TLS1.3 0-RTT. dkg put together some threat models and instead of forwarding some long thread, I figure I would put this out there and let Mr. Gilmor lay out his theories. Daniel, you're it. tim