Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Define transport parameters #122

Merged
merged 27 commits into from
Feb 21, 2017
Merged
Show file tree
Hide file tree
Changes from 26 commits
Commits
Show all changes
27 commits
Select commit Hold shift + click to select a range
05e8483
Removes use of the word crypto
Feb 17, 2017
4890980
Revert "Replace uses of the word crypto with cryptographic"
Feb 17, 2017
c68d4c3
Add definition of transport parameters to -transport
martinthomson Jan 4, 2017
df6be7d
Define the extension in -tls
martinthomson Jan 4, 2017
54b4a61
Add a stub iana section, fix dead references
martinthomson Jan 4, 2017
58b44bf
Remove COPT, add rule about unknown extensions
martinthomson Feb 7, 2017
69682c8
Reference WINDOW_UPDATE properly
martinthomson Feb 7, 2017
c6f4388
Remove extra sentence on ignoring unknown parameters
martinthomson Feb 7, 2017
4e553f5
editorial
martinthomson Feb 7, 2017
c003df8
Correct reference
martinthomson Feb 7, 2017
ff697d3
Move crypto requirements to head of section
martinthomson Feb 7, 2017
0a927e4
Wrap note
martinthomson Feb 7, 2017
b251df5
Remove QUIC-Crypto reference
martinthomson Feb 7, 2017
64e9772
Transport parameter are available when the handshake completes
martinthomson Feb 7, 2017
081ef5e
Simplify the section on new parameters
martinthomson Feb 7, 2017
e5d5bf4
Add IANA considerations
martinthomson Feb 7, 2017
665a59a
Add transport parameters to the handshake interface in TLS
martinthomson Feb 7, 2017
895a68e
Fix formatting
martinthomson Feb 7, 2017
06a8935
Proofread version negotiation and correct errors
martinthomson Feb 7, 2017
10be7da
Use hex, add initial registry contents
martinthomson Feb 7, 2017
e671b0d
Transport parameters during 0-RTT are either remembered or defaults
martinthomson Feb 7, 2017
bb4f04d
Fix long line
martinthomson Feb 18, 2017
8922744
Rename transport parameters, closes #300
martinthomson Feb 20, 2017
8e5a538
Cryptographic handshake, blah, blah
martinthomson Feb 20, 2017
0fada3c
Jana's review comments
martinthomson Feb 20, 2017
686aad7
Correct line length
martinthomson Feb 20, 2017
1ffe4e9
Fix case
martinthomson Feb 21, 2017
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
67 changes: 39 additions & 28 deletions draft-ietf-quic-tls.md
Original file line number Diff line number Diff line change
Expand Up @@ -370,6 +370,9 @@ handshake messages on stream 1. There are two basic functions on this
interface: one where QUIC requests handshake messages and one where QUIC
provides handshake packets.

Before starting the handshake QUIC provides TLS with the transport parameters
(see {{quic_parameters}}) that it wishes to carry.

A QUIC client starts TLS by requesting TLS handshake octets from
TLS. The client acquires handshake octets before sending its first packet.

Expand All @@ -381,12 +384,14 @@ octets are requested from TLS. TLS might not provide any octets if the
handshake messages it has received are incomplete or it has no data to send.

Once the TLS handshake is complete, this is indicated to QUIC along with any
final handshake octets that TLS needs to send. Once the handshake is complete,
TLS becomes passive. TLS can still receive data from its peer and respond in
kind that data, but it will not need to send more data unless specifically
requested - either by an application or QUIC. One reason to send data is that
the server might wish to provide additional or updated session tickets to a
client.
final handshake octets that TLS needs to send. TLS also provides QUIC with the
transport parameters that the peer advertised during the handshake.

Once the handshake is complete, TLS becomes passive. TLS can still receive data
from its peer and respond in kind, but it will not need to send more data unless
specifically requested - either by an application or QUIC. One reason to send
data is that the server might wish to provide additional or updated session
tickets to a client.

When the handshake is complete, QUIC only needs to provide TLS with any data
that arrives on stream 1. In the same way that is done during the handshake,
Expand Down Expand Up @@ -973,11 +978,13 @@ prior to handshake completion:
Different strategies are appropriate for different types of data. This document
proposes that all strategies are possible depending on the type of message.

* Transport parameters and options are made usable and authenticated as part of
the TLS handshake (see {{quic_parameters}}).
* Transport parameters are made usable and authenticated as part of the TLS
handshake (see {{quic_parameters}}).

* Most unprotected messages are treated as fatal errors when received except for
the small number necessary to permit the handshake to complete (see
{{pre-hs-unprotected}}).

* Protected packets can either be discarded or saved and later used (see
{{pre-hs-protected}}).

Expand Down Expand Up @@ -1141,31 +1148,35 @@ protection for the QUIC negotiation. This does not prevent version downgrade
during the handshake, though it means that such a downgrade causes a handshake
failure.

Protocols that use the QUIC transport MUST use Application Layer Protocol
Negotiation (ALPN) {{!RFC7301}}. The ALPN identifier for the protocol MUST be
specific to the QUIC version that it operates over. When constructing a
ClientHello, clients MUST include a list of all the ALPN identifiers that they
support, regardless of whether the QUIC version that they have currently
selected supports that protocol.
TLS uses Application Layer Protocol Negotiation (ALPN) {{!RFC7301}} to select an
application protocol. The application-layer protocol MAY restrict the QUIC
versions that it can operate over. Servers MUST select an application protocol
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I would leave out what the application protocol MAY do from this doc

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I actually think this is appropriate, because it's describing how app-protocol selection works. TLS already enables you to advertise lists of things you support, not all of which are rational combinations. This is describing how TLS should handle ALPN in QUIC.

However, if you wanted to move part of this text to the -transport document and describe app-protocol selection independent of the crypto protocol in use, I wouldn't object.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Having considered this, I think you're right. This makes sense in the context of describing how ALPN ought to work for QUIC. SGTM.

compatible with the QUIC version that the client has selected.

Servers SHOULD select an application protocol based solely on the information in
the ClientHello, not using the QUIC version that the client has selected. If
the protocol that is selected is not supported with the QUIC version that is in
use, the server MAY send a QUIC version negotiation packet to select a
compatible version.
If the server cannot select a compatible combination of application protocol and
QUIC version, it MUST abort the connection. A client MUST abort a connection if
the server picks an incompatible combination of QUIC version and ALPN
identifier.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I would leave this para out, since it's not for TLS to do. I think this belongs in the HTTP mapping doc.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

As before. It is for TLS to do, since the server will run into this while trying to process ALPN, but you're correct that it's going to be an issue for any crypto protocol.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, you're right. I hadn't fully processed ALPN and the new world order, but I think it makes sense when considering how TLS would use ALPN with QUIC.


If the server cannot select a combination of ALPN identifier and QUIC version it
MUST abort the connection. A client MUST abort a connection if the server picks
an incompatible version of QUIC version and ALPN.

## QUIC Transport Parameters Extension {#quic_parameters}

## QUIC Extension {#quic_parameters}
QUIC transport parameters are carried in a TLS extension. Different versions of
QUIC might define a different format for this struct.

Including transport parameters in the TLS handshake provides integrity
protection for these values.

~~~
enum {
quic_transport_parameters(26), (65535)
} ExtensionType;
~~~

QUIC defines an extension for use with TLS. That extension defines
transport-related parameters. This provides integrity protection for these
values. Including these in the TLS handshake also make the values that a client
sets available to a server one-round trip earlier than parameters that are
carried in QUIC packets. This document does not define that extension.
The `extension_data` field of the quic_transport_parameters extension contains a
value that is defined by the version of QUIC that is in use. The
quic_transport_parameters extension carries a TransportParameters when the
version of QUIC defined in {{QUIC-TRANSPORT}} is used.


## Priming 0-RTT
Expand Down
Loading