Subject: Re: [core] Connection ID

From: Jim Schaad <[email-masked]>
Date: Sat, 2 Dec 2017 15:11:04 -0800

-----Original Message-----
From: core [mailto:[email-masked]] On Behalf Of Carsten Bormann
Sent: Monday, November 20, 2017 9:55 AM
To: Hannes Tschofenig <[email-masked]>
Cc: Hannes Tschofenig <[email-masked]>; [email-masked] WG <[email-masked]>
Subject: Re: [core] Connection ID

On Nov 20, 2017, at 15:17, Hannes Tschofenig <[email-masked]> wrote:
> 
> Hi all,
> 
> some of you may have missed the TLS WG meeting last week where we had 
> a discussion about the Connection ID. The slides can be found at 
> https://datatracker.ietf.org/meeting/100/materials/slides-100-tls-sess
> a-connection-id/
> and the draft itself is here:
> https://tools.ietf.org/html/draft-rescorla-tls-dtls-connection-id-02
> 
> I am bringing this to your attention since there have been several 
> discussions about problems with expired NAT bindings and DTLS on this 
> mailing list.
> 
> Here is the good news: the TLS WG meeting participants expressed 
> strong consensus to adopt this work.
> 
> We are planning to advance the work rapidly given the urgency. There 
> are open issues, which we plan to address in the next couple of weeks. 
> Then, we would like to do an online interop test. If you have an 
> implementation please drop me a private mail.
> 
> Ciao
> Hannes
> 
> PS: Note that the latest DTLS 1.3 spec now includes an optimized 
> record layer format, which can be used with the connection ID draft. 
> This leads to a smaller per packet overhead.

This is all very good.

RFC 7252 still says:

   The following rules are added for matching an Acknowledgement message
   or Reset message to a Confirmable message, or a Reset message to a
   Non-confirmable message: The DTLS session MUST be the same, and the
   epoch MUST be the same.

Apparently, we need to relax the rule about the epoch.
Should we just strike this part, or is there going to be a weaker rule?

[JLS] I would say that the session might need to be the same, but I am not sure.  Something that connects the sessions would be required so say that the sessions are the same (hello connection id?). The epoch should be able to change w/o a problem.

Jim

Grüße, Carsten

_______________________________________________
core mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/core