Remove "baseline TLS" handshake reconstruction #60

bemasc · 2022-06-28T02:19:26Z

This is a radical change that attempts to implement the (possible)
consensus to move from a "reconstruction-based" transcript to a
"non-reconstruction" transcript. Verifying the transcript without
reconstruction requires the transcript to include the template,
which requires a byte-identical representation of the template.
This change makes this possible by introducing a stable binary
representation of the template, with JSON as a human-readable
alternative.

This change also attempts to:

Formalize the notion of when vector lengths can be omitted
Rearrange the extension templating in a more convenient fashion

Fixes #57

Fixes #41, #42

This is a radical change that attempts to implement the (possible) consensus to move from a "reconstruction-based" transcript to a "non-reconstruction" transcript. Verifying the transcript without reconstruction requires the transcript to include the template, which requires a byte-identical representation of the template. This change makes this possible by introducing a stable binary representation of the template, with JSON as a human-readable alternative. This change also attempts to: * Clarify the use of cTLS in datagram contexts - Including how retransmission works without sequence numbers * Formalize the notion of when vector lengths can be omitted * Rearrange the extension templating in a more convenient fashion Fixes #57

bemasc · 2022-06-28T02:19:47Z

Blocked by #55 and #59

ekr

I like the way this is going, but I think we probably can't quite land it before IETF. Once you've had a chance to respond to these comments, let's take the remaining ones to discussion.

draft-ietf-tls-ctls.md

ekr · 2022-07-01T03:21:23Z

draft-ietf-tls-ctls.md

+For ease of configuration, an equivalent JSON dictionary format is also defined.
+It consists of a dictionary whose keys are the name of each element type (converted
+from snake_case to camelCase), and whose values are a type-specific representation
+of the element intended to maximize legibility.


Is this change separable?

I'm not sure what you mean. I've put up #61 as an intermediate step that introduces the binary format without changing the transcript.

If you mean creating a version that doesn't define a JSON format at all: that is possible, but I didn't want to remove the JSON option without asking. I have no strong preference on whether we define a JSON format.

ekr · 2022-07-01T03:21:54Z

draft-ietf-tls-ctls.md

+Value: a single `ProtocolVersion` ({{!RFC8446, Section 4.1.2}}) that both parties agree to use. For TLS 1.3, the `ProtocolVersion` is 0x0304.
+
+When this element is included, the `supported_versions` extension
+is omitted from ClientHello.extensions, and the


Something missing here.

Fixed, thanks.

draft-ietf-tls-ctls.md

ekr · 2022-07-01T03:25:36Z

draft-ietf-tls-ctls.md

+* `extension_type` is omitted because it is specified by `expected_extensions`
+* The length of `extensions` is omitted because `allow_additional` is false, the number of items in `extensions` (i.e., 1) is known in advance.
+
+The only exception to this rule is `ClientHello.profile_id`, which is processed before the profile is known.


How clever will one have to be to get this right?

My goal here was mostly to capture a behavior that was implied by some examples but not described anywhere in the text. I've attempted to make this rule more explicit, to avoid any tricky reasoning being required.

draft-ietf-tls-ctls.md

ekr · 2022-07-01T03:27:30Z

draft-ietf-tls-ctls.md

+containing the `CTLSTemplate` used for this connection.  This message is
+included in the transcript even though it is not exchanged during connection
+setup, in order to ensure that both parties are using the same template.
+Subsequent messages are appended to the transcript as usual.


We may have to consume a handshake type for this to ensure it's injective.

Yes, that's in the IANA section. I've attempted to make that clearer here.

martinthomson · 2022-07-01T04:04:49Z

draft-ietf-tls-ctls.md

+struct {
+  CTLSTemplateElement elements<0..2^32-1>
+} CTLSTemplate;


I think that this needs some sort of unambiguous identifier, like a version number, that ensures that we can replace this. Maybe that's included in the process for integrating that into the transcript (ctls_template), which is OK, but a system for replacing this scheme with a better one is very important to have, even if this turns out to be perfect the first time.

OK, I added CTLSTemplate.ctls_version field.

draft-ietf-tls-ctls.md

This is an intermediate step toward being able to include the template in the transcript (#60). It also enables more efficient distribution of cTLS templates. See also #57

ekr

I think this could use with some refinement, but it would be better in the draft than out.

Ben Schwartz added 5 commits June 8, 2022 14:58

Specify framing mode

5b965c8

Fixes #41, #42

Add the corresponding IANA entry

9197159

Also add myself to the list

14109da

Merge branch 'bemasc-framing' into tmp-profile-id-plus-framing

ce7509e

bemasc mentioned this pull request Jun 28, 2022

Figure out which transcript is authenticated #57

Closed

Ben Schwartz added 3 commits June 28, 2022 12:34

Exception to static vector compression for ClientHello.profile_id

976bc40

Fix enum

2fec601

Fix element type lists

63c56e4

ekr requested changes Jul 1, 2022

View reviewed changes

martinthomson reviewed Jul 1, 2022

View reviewed changes

draft-ietf-tls-ctls.md Outdated Show resolved Hide resolved

Ben Schwartz added 5 commits July 1, 2022 13:13

Fix support for reordering and demultiplexing

aada214

Merge branch 'master' into bemasc-framing

d3374f9

Use correct struct name

be39015

Merge branch 'bemasc-framing' into bemasc-transcript

75b3fbd

Respond to review comments

cd9eb37

bemasc force-pushed the bemasc-transcript branch from 67d1c46 to cd9eb37 Compare July 1, 2022 18:29

bemasc pushed a commit that referenced this pull request Jul 1, 2022

Define a binary encoding for cTLS templates

2c3986f

This is an intermediate step toward being able to include the template in the transcript (#60). It also enables more efficient distribution of cTLS templates. See also #57

bemasc mentioned this pull request Jul 1, 2022

Define a binary encoding for cTLS templates #61

Closed

bemasc requested a review from ekr July 1, 2022 18:59

ekr approved these changes Jul 7, 2022

View reviewed changes

bemasc marked this pull request as ready for review July 8, 2022 11:54

bemasc changed the title ~~Proposal: cTLS without reconstruction~~ Remove "baseline TLS" handshake reconstruction Jul 8, 2022

bemasc merged commit 798929b into master Jul 8, 2022

bemasc deleted the bemasc-transcript branch July 8, 2022 16:20

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Remove "baseline TLS" handshake reconstruction #60

Remove "baseline TLS" handshake reconstruction #60

bemasc commented Jun 28, 2022 •

edited

Loading

bemasc commented Jun 28, 2022

ekr left a comment

ekr Jul 1, 2022

bemasc Jul 1, 2022

ekr Jul 1, 2022

bemasc Jul 1, 2022

ekr Jul 1, 2022

bemasc Jul 1, 2022

ekr Jul 1, 2022

bemasc Jul 1, 2022

martinthomson Jul 1, 2022

bemasc Jul 1, 2022

ekr left a comment

Remove "baseline TLS" handshake reconstruction #60

Remove "baseline TLS" handshake reconstruction #60

Conversation

bemasc commented Jun 28, 2022 • edited Loading

bemasc commented Jun 28, 2022

ekr left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ekr left a comment

Choose a reason for hiding this comment

bemasc commented Jun 28, 2022 •

edited

Loading