On Thu, Dec 14, 2017 at 4:47 PM Ilari Liusvaara <ilariliusva...@welho.com> wrote:
> On Tue, Dec 12, 2017 at 06:43:19PM -0600, Martin Thomson wrote: > > On Tue, Dec 12, 2017 at 6:32 PM, Victor Vasiliev <vasi...@google.com> > wrote: > > > https://github.com/tlswg/certificate-compression/pull/8 > > > > That's a lot cleaner. Thanks. Some minor quibbles, but I like this > > construction far better. > > Yeah, same here, I like this construction far better than the -01 one. > > > A question about client certificates prior to TLS 1.3: Are we happy > > making compression for client certificates only available in TLS 1.3 > > (or higher if we can assume that we will maintain parity in future)? > > I think that I can live with that. > > As others have said, this extension is basically undeployable with > TLS 1.2 because middleboxes. > Another observation about the middlebox issue: if we leave the text as-is, where it is defined for TLS 1.2 server certificates, but we all silently agree that servers should decline it at TLS 1.2, clients are still obligated to implement it in their TLS 1.2 state machine because the advertisement is the same. If we're never going to deploy it in TLS 1.2 anyway, this seems like a waste of the complexity budget. Better to say it is not defined for TLS 1.2 at all because of non-compliant middleboxes and avoid all this ambiguity. > Also, assuming parity in the future might not be a good idea. Does > anyone have any idea what TLS 1.4 might be about[1] (TLS 2.0 would > likely be about cleaning representation, but that would likely be a > bad idea)? > > > [1] Not Post-Quantum Cryptography. Integrating PQC into TLS 1.3 is not > a difficult task (once you know the trick). And I do not see TLS > changes making it any easier without weakening security. > > > > -Ilari > > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls >
_______________________________________________ TLS mailing list TLS@ietf.org https://www.ietf.org/mailman/listinfo/tls
