On Wed, Nov 23, 2016 at 5:25 AM, Olivier Levillain < [email protected]> wrote:
> >> There were actually two points in my message: > >> - I was not convinced by this way of signalling a preference without > >> enforcing it, but I understand that, if we keep supported_groups, it > >> does not cost much and the client can safely ignore the server sent > >> extension; > >> - however, I found strange that the specification stated that the > >> client could update its view when seeing this extension, but that it was > >> not stated in the case of an HRR where updating its views of the > >> servers' preference would clearly be useful for the future. I only > >> proposed to add the same text "The client MAY update its view of the > >> server's preference when receiving an HRR, to avoid the extra round trip > >> in future encounters". > >> > > This is is unsafe, because the HRR is unauthenticated. We could update it > > after the handshake completes, but I think this is obvious enough that it > > doesn't > > need to be stated. > > Unless I am mistaken, EncryptedExtensions is not authenticated either > (even if it is sent in the same flight as the authentication messages), > so updating the client cache can not be done immediately after > interpreting the supported_groups extension. > That is intended to be covered by the following text: by the client. Clients MUST NOT act upon any information found in "supported_groups" prior to successful completion of the handshake, but MAY use the information learned from a successfully completed handshake to change what groups they use in their "key_share" extension in subsequent connections. My point about HRR is that the client can generally update its opinion based on what it successfully completed the handshake with. This can happen either with HRR or when it offered >1 shares and the server took one. The special case is when supported_versions indicates a key type you didn't use. So I think if we wanted text around this it would go somewhere that covered the general case. I'm not sure it's needed but if the WG feels like we should add some text, I can... -Ekr > However, if you believe this does not need to be stated, I am fine with > that. > > olivier >
_______________________________________________ TLS mailing list [email protected] https://www.ietf.org/mailman/listinfo/tls
