Re: [TLS] record layer limits of TLS1.3

2016-11-27 Thread Benjamin Kaduk
On 11/23/2016 02:46 AM, Judson Wilson wrote: > I worry about the buffer sizes required on embedded devices. Hopefully > the other endpoint would be programmed to limit record sizes, but is > that something we want to rely on? This could be a parameter agreed > upon during the handshake, but that

Re: [TLS] record layer limits of TLS1.3

2016-11-25 Thread Jeremy Harris
On 23/11/16 19:13, Watson Ladd wrote: > On Nov 23, 2016 10:22 AM, "Jeremy Harris" wrote: >> >> On 23/11/16 08:50, Yoav Nir wrote: >>> As long as you run over a network that has a smallish MTU, you’re going > to incur the packetization costs anyway, either in your code or in >

Re: [TLS] record layer limits of TLS1.3

2016-11-24 Thread Vlad Krasnov
A) OpenSSL does not measure the actual TLS performance (including nonce construction, additional data, etc), but rather just the speed of the main encryption loop. B) Still, I agree with Yoav. From my experience, the difference in TPT between 16K records and 64K records is negligible, as well

Re: [TLS] record layer limits of TLS1.3

2016-11-24 Thread Yoav Nir
> On 24 Nov 2016, at 15:47, Hubert Kario wrote: > > On Wednesday, 23 November 2016 10:50:37 CET Yoav Nir wrote: >> On 23 Nov 2016, at 10:30, Nikos Mavrogiannopoulos wrote: >>> On Wed, 2016-11-23 at 10:05 +0200, Yoav Nir wrote: Hi, Nikos On 23

Re: [TLS] record layer limits of TLS1.3

2016-11-24 Thread Hubert Kario
On Wednesday, 23 November 2016 10:50:37 CET Yoav Nir wrote: > On 23 Nov 2016, at 10:30, Nikos Mavrogiannopoulos wrote: > > On Wed, 2016-11-23 at 10:05 +0200, Yoav Nir wrote: > >> Hi, Nikos > >> > >> On 23 Nov 2016, at 9:06, Nikos Mavrogiannopoulos > > That to

Re: [TLS] record layer limits of TLS1.3

2016-11-23 Thread Watson Ladd
On Nov 23, 2016 10:22 AM, "Jeremy Harris" wrote: > > On 23/11/16 08:50, Yoav Nir wrote: > > As long as you run over a network that has a smallish MTU, you’re going to incur the packetization costs anyway, either in your code or in operating system code. If you have a 1.44 GB

Re: [TLS] record layer limits of TLS1.3

2016-11-23 Thread Jeremy Harris
On 23/11/16 08:50, Yoav Nir wrote: > As long as you run over a network that has a smallish MTU, you’re going to > incur the packetization costs anyway, either in your code or in operating > system code. If you have a 1.44 GB file you want to send, it’s going to take > a million IP packets

Re: [TLS] record layer limits of TLS1.3

2016-11-23 Thread Michael Tuexen
> On 23 Nov 2016, at 09:50, Yoav Nir wrote: > > > On 23 Nov 2016, at 10:30, Nikos Mavrogiannopoulos wrote: > >> On Wed, 2016-11-23 at 10:05 +0200, Yoav Nir wrote: >>> Hi, Nikos >>> >>> On 23 Nov 2016, at 9:06, Nikos Mavrogiannopoulos

Re: [TLS] record layer limits of TLS1.3

2016-11-23 Thread Nikos Mavrogiannopoulos
Maybe a solution would be a better maximum fragment length extension which allows the size can be negotiated in a more fine-grained way, as pointed in: https://www.ietf.org/mail-archive/web/tls/current/msg12472.html I also found these requests asking for larger packet sizes.

Re: [TLS] record layer limits of TLS1.3

2016-11-23 Thread Yoav Nir
On 23 Nov 2016, at 10:30, Nikos Mavrogiannopoulos wrote: > On Wed, 2016-11-23 at 10:05 +0200, Yoav Nir wrote: >> Hi, Nikos >> >> On 23 Nov 2016, at 9:06, Nikos Mavrogiannopoulos >> wrote: >> >>> >>> Hi, >>> Up to the current draft of TLS1.3 the record

Re: [TLS] record layer limits of TLS1.3

2016-11-23 Thread Judson Wilson
I worry about the buffer sizes required on embedded devices. Hopefully the other endpoint would be programmed to limit record sizes, but is that something we want to rely on? This could be a parameter agreed upon during the handshake, but that seems bad. On Wed, Nov 23, 2016 at 12:41 AM, Nikos

Re: [TLS] record layer limits of TLS1.3

2016-11-23 Thread Judson Wilson
Can you send multiple records in one data transfer to achieve whatever gains are desired? On Wed, Nov 23, 2016 at 12:30 AM, Nikos Mavrogiannopoulos wrote: > On Wed, 2016-11-23 at 10:05 +0200, Yoav Nir wrote: > > Hi, Nikos > > > > On 23 Nov 2016, at 9:06, Nikos Mavrogiannopoulos

Re: [TLS] record layer limits of TLS1.3

2016-11-23 Thread Nikos Mavrogiannopoulos
On Wed, 2016-11-23 at 10:05 +0200, Yoav Nir wrote: > Hi, Nikos > > On 23 Nov 2016, at 9:06, Nikos Mavrogiannopoulos > wrote: > > > > > Hi, > >  Up to the current draft of TLS1.3 the record layer is restricted > > to > > sending 2^14 or less. Is the 2^14 number something we

Re: [TLS] record layer limits of TLS1.3

2016-11-23 Thread Yoav Nir
Hi, Nikos On 23 Nov 2016, at 9:06, Nikos Mavrogiannopoulos wrote: > Hi, > Up to the current draft of TLS1.3 the record layer is restricted to > sending 2^14 or less. Is the 2^14 number something we want to preserve? > 16kb used to be a lot, but today if one wants to do fast