Subject: [quicwg/base-drafts] Certificate compression (#134)

From: Martin Thomson <[email-masked]>
Date: Mon, 09 Jan 2017 20:23:48 -0800

The document currently (though I hope to remove this) makes certificate compression a requirement of the cryptographic handshake.  TLS doesn't really do compression, though it does provided cached-info ([RFC 7924](https://tools.ietf.org/html/7924)).  Is this sufficient or do we need to ask the TLS working group for a compression feature.  I'm assuming that if we did need to ask, we would also be responsible for providing a design.

Note that TLS 1.3 aims to provide confidentiality for certificates and compression is generally fraught with hazards that compromise confidentiality.  It also potentially a feature that could leak information about a client's past connections to servers.  If we due pursue this, any design we create would need to carefully consider these (and likely other) risks.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/134

---

From: Alessandro Ghedini <[email-masked]>
Date: Tue, 10 Jan 2017 03:27:19 -0800

FTR I raised the issue on the TLS list [here](https://www.ietf.org/mail-archive/web/tls/current/msg22065.html), however the main response was "compression is scary", but it could just be due to lack of details on my part.

Unfortunately I haven't been able to find the time to do any experimenting (or indeed reply to the mail thread), and haven't heard from Victor.

As for caching, it seems to me RFC7924 is quite a bit less flexible than what we have in Google QUIC (namely, you can only cache full chains, not single entries AFAICT, so e.g. you can't just cache intermediates), but again haven't been able to do any experimenting.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/134#issuecomment-271552046

---

From: Victor Vasiliev <[email-masked]>
Date: Mon, 23 Jan 2017 22:34:44 -0800

I am still working on figuring out what would be the impact of compression with and without a pre-shared dictionary, as well as what dictionary we should use.  I expect to have some preliminary answers in a week or two.

With regards to the other ways of compression, I feel like both RFC 7924 and QUIC-style cached certificate chain should not matter in most cases since if we talked to a host before, what we really want is to just do a session resumption.  But I might be wrong, and I am not sure how a cert cache would behave in real-life situations when a lot of sites use it.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/134#issuecomment-274721820