the cryptographic algorithms listed continue to provide the expected level of security.  19. This document is entirely about changes to TLS-related IANA

Addresses and .
Seems like we should add a security consideration about the expert and how much review they're going to do.
We probably need to say something more in the security considerations. What springs to mind first is the implications of relaxing to specification required for cipher suites and named groups. There must be others.

the cryptographic algorithms listed continue to provide the expected level of security. <ins> Designated experts ensure the specification is publicly available. They may provide more in depth reviews.  Their review should not be taken as an endorsement of the cipher suite, extension, supported group, etc. </ins> 19. This document is entirely about changes to TLS-related IANA


marked "No" range from "good" to "bad" from a cryptographic standpoint.  The designated expert RFC8126 only ensures that the specification is publicly available.

Addresses and .
CCM_8 has a significantly truncated authentication tag that represents a security trade-off that may not be appropriate for general environment.
I think not.
LGTM. Can you send me a PR for the TLS 1.3 spec.

marked "No" range from "good" to "bad" from a cryptographic standpoint. <ins> CCM_8 cipher suites are not marked as Recommended.  These cipher suites have a significantly truncated authentication tag that represents a security trade-off that may not be appropriate for general environments. </ins> The designated expert RFC8126 only ensures that the specification is publicly available.


nomenclature for the other Handshake type names and to match with existing implementations. <del> Rename the SessionTicket TLS to session_ticket to match the nomenclature for the other extensions' names. </del>  Add missing entry to the TLS Alert Registry for the no_application_protocol alert defined in RFC7301. Note(1): Although TLS 1.3 uses the same cipher suite space as previous versions of TLS, TLS 1.3 cipher suites are defined <del> differently, only specifying the symmetric ciphers, and cannot it be used for TLS 1.2.  Similarly, TLS 1.2 and lower cipher suites </del>  cannot be used with TLS 1.3. Note(2): Cipher suites marked as "Yes" are those allocated via Change the registry policy to: Values in the range 0-223 are assigned via Specification Required <del> RFC5226.  Values 224-255 are are reserved for Private Use. </del>  Add the following:

This PR and
ship it
From the draft: Remove one "are" from "are are reserved".
Remove the "it" from "cannot it" in the text below:
From the Introduction section: As far as I can see the above ought to be:

nomenclature for the other Handshake type names and to match with existing implementations.  <ins> Rename the SessionTicket TLS extension to session_ticket to match the nomenclature for the other extensions' names. </ins> Add missing entry to the TLS Alert Registry for the no_application_protocol alert defined in RFC7301. Note(1): Although TLS 1.3 uses the same cipher suite space as previous versions of TLS, TLS 1.3 cipher suites are defined  <ins> differently, only specifying the symmetric ciphers, and cannot be used for TLS 1.2.  Similarly, TLS 1.2 and lower cipher suites </ins> cannot be used with TLS 1.3. Note(2): Cipher suites marked as "Yes" are those allocated via Change the registry policy to: Values in the range 0-223 are assigned via Specification Required  <ins> RFC5226.  Values 224-255 are reserved for Private Use. </ins> Add the following:


This table has been generated by marking Standards Track RFCs as "Yes" and all others as "No".  Future extensions MUST define the value of the Recommended column.  A Standards Track document <del> RFC8126 is required to register an extension with the value "Yes". </del>  9. cipher suites that follow in the two tables are marked as "Yes". All other cipher suites are marked as "No".  Future cipher suites MUST define the value of the Recommended column.  A Standards <del> Track document RFC8126 is required to register a cipher suite with the value "Yes". </del>  The cipher suites that follow are standards track server- authenticated (and optionally client-authenticated) cipher suites are marked as "Yes"; these groups apply to TLS 1.3 I-D.ietf-tls-tls13 and previous versions of TLS.  Future supported groups MUST define the value of this column.  A Standards Track document RFC8126 is <del> required to register an entry with the value "Yes". </del>  IANA [SHALL add/has added] the following note: table that follows has been generated by marking Standards Track RFCs as "Yes" and all others as "No".  Future exporters MUST define the value of this column.  A Standards Track document <del> RFC8126 is required to register an extension with the value "Yes". </del>  To provide additional information for the designated experts, IANA [SHALL add/has added] the following note: "Yes".  All others are "No".  A Standards Track document RFC8126 is required to register a certificate type with the value "Yes".  Future Certificate Types MUST define the value of this column.  A Standards <del> Track document RFC8126 is required to register an entry with the value "Yes". </del>  See expert-pool for additional information about the designated expert pool.

Addresses .
Our esteemed Shepherd has pointed out that we need to specify the rules for going from Yes->No. After consulting the list, we settled on "IESG action is REQUIRED for a Yes->No transition."
Closed as part of .

This table has been generated by marking Standards Track RFCs as "Yes" and all others as "No".  Future extensions MUST define the value of the Recommended column.  A Standards Track document  <ins> RFC8126 is REQUIRED to register an extension with the value "Yes". IESG action is REQUIRED for a Yes->No transition. </ins> 9. cipher suites that follow in the two tables are marked as "Yes". All other cipher suites are marked as "No".  Future cipher suites MUST define the value of the Recommended column.  A Standards  <ins> Track document RFC8126 is REQUIRED to register a cipher suite with the value "Yes".  IESG action is REQUIRED for a Yes->No transition. </ins> The cipher suites that follow are standards track server- authenticated (and optionally client-authenticated) cipher suites are marked as "Yes"; these groups apply to TLS 1.3 I-D.ietf-tls-tls13 and previous versions of TLS.  Future supported groups MUST define the value of this column.  A Standards Track document RFC8126 is  <ins> REQUIRED to register an entry with the value "Yes".  IESG action is REQUIRED for a Yes->No transition. </ins> IANA [SHALL add/has added] the following note: table that follows has been generated by marking Standards Track RFCs as "Yes" and all others as "No".  Future exporters MUST define the value of this column.  A Standards Track document  <ins> RFC8126 is REQUIRED to register an extension with the value "Yes". IESG action is REQUIRED for a Yes->No transition. </ins> To provide additional information for the designated experts, IANA [SHALL add/has added] the following note: "Yes".  All others are "No".  A Standards Track document RFC8126 is required to register a certificate type with the value "Yes".  Future Certificate Types MUST define the value of this column.  A Standards  <ins> Track document RFC8126 is REQUIRED to register an entry with the value "Yes".  IESG action is REQUIRED for a Yes->No transition. </ins> See expert-pool for additional information about the designated expert pool.


6. <del> The instructions in this document add a recommended column to many of </del>  the TLS registries to indicate parameters that are generally recommended for implementations to support.  Adding a recommended parameter to a registry or updating a parameter to recommended status Update the "Reference" to also refer to this document. <del> Add the following note: </del>  Experts are to verify that there is in fact a publicly available standard.  See expert-pool for additional information about the designated expert pool. RFC8126 is REQUIRED to register an extension with the value "Yes". IESG action is REQUIRED for a Yes->No transition.  9. Experience has shown that the IETF Consensus registry policy for TLS RFC EDITOR: The previous paragraph is for document reviewers and is not meant for the registry. <del> Despite the following behavior being crazy, experience has shown that some customers use the IANA registry as checklist against which to measure an implementation's completeness and some implementers </del>  blindly implement cipher suites.  Therefore, IANA [SHALL add/has added] the following warning to the registry: marked "No" range from "good" to "bad" from a cryptographic standpoint. <del> CCM_8 cipher suites are not marked as Recommended.  These cipher </del>  suites have a significantly truncated authentication tag that represents a security trade-off that may not be appropriate for general environments.  The designated expert RFC8126 only ensures that the specification is publicly available.  IANA [SHALL update/has updated] the reference for this registry to also refer to this document. The designated expert RFC8126 only ensures that the specification is publicly available. <del> Despite the following behavior being crazy, experience has shown that some customers use the IANA registry as checklist against which to measure an implementation's completeness and some implementers blindly implement cipher supported.  Therefore, IANA [SHALL add/has </del>  added] the following warning to the registry: Cryptographic algorithms and parameters will be broken or weakened The designated expert RFC8126 only ensures that the specification is publicly available.  ClientCertificateType Identifiers marked as "Yes" are those allocated via Standards Track RFCs.  ClientCertificateTypes marked as "No" are not.

NAME let me know what you think.
I.e., if you actually deploy on the Internet with these experimental code points, and you run into someone using the same code point, you're going to have a bad day. For widespread experiments, we should really be using temporary reservations of some kind instead.
NAME NAME How about we add the following note everywhere we added private use: NOTE: : As specified in {{RFC5226}}, assignments made in the Private Use space "are not generally useful for broad interoperability." It is the responsibility of those making use of the Private Use range to ensure that no conflicts occur (within the intended scope of use). For widespread experiments, temporary reservations are available.
LGTM.
Addressed by .

6.  <ins> The instructions in this document add a Recommended column to many of </ins> the TLS registries to indicate parameters that are generally recommended for implementations to support.  Adding a recommended parameter to a registry or updating a parameter to recommended status Update the "Reference" to also refer to this document.  <ins> Add the following notes: </ins> Experts are to verify that there is in fact a publicly available standard. <ins> As specified in RFC8126, assignments made in the Private Use space are not generally useful for broad interoperability.  It is the responsibility of those making use of the Private Use range to ensure that no conflicts occur (within the intended scope of use). For widespread experiments, temporary reservations are available. </ins> See expert-pool for additional information about the designated expert pool. RFC8126 is REQUIRED to register an extension with the value "Yes". IESG action is REQUIRED for a Yes->No transition. <ins> The following is from I-D.ietf-tls-tls13 and is included here to ensure aligment between these specifications. I-D.ietf-tls-tls13 also uses the TLS ExtensionType Registry originally created in RFC4366.  IANA has updated it to reference this document.  The registry and its allocation policy is listed below: IANA [SHALL update/has updated] this registry to include the "key_share", "pre_shared_key", "psk_key_exchange_modes", "early_data", "cookie", "supported_versions", "certificate_authorities", "oid_filters", "post_handshake_auth", and "signature_algorithms_certs", extensions with the values defined in this document and the Recommended value of "Yes". IANA [SHALL update/has updated] this registry to include a "TLS 1.3" column which lists the messages in which the extension may appear.  This column [SHALL be/has been] initially populated from the table in Section 4.2 of I-D.ietf-tls-tls13 with any extension not listed there marked as "-" to indicate that it is not used by TLS 1.3. </ins> 9. Experience has shown that the IETF Consensus registry policy for TLS RFC EDITOR: The previous paragraph is for document reviewers and is not meant for the registry.  <ins> Despite the following behavior being misguided, experience has shown that some customers use the IANA registry as checklist against which to measure an implementation's completeness and some implementers </ins> blindly implement cipher suites.  Therefore, IANA [SHALL add/has added] the following warning to the registry: marked "No" range from "good" to "bad" from a cryptographic standpoint.  <ins> CCM_8 cipher suites are not marked as recommended.  These cipher </ins> suites have a significantly truncated authentication tag that represents a security trade-off that may not be appropriate for general environments. <ins> IANA [SHALL add/has added] the following notes for additional information: </ins> The designated expert RFC8126 only ensures that the specification is publicly available. <ins> As specified in RFC8126, assignments made in the Private Use space are not generally useful for broad interoperability.  It is the responsibility of those making use of the Private Use range to ensure that no conflicts occur (within the intended scope of use). For widespread experiments, temporary reservations are available. </ins> IANA [SHALL update/has updated] the reference for this registry to also refer to this document. The designated expert RFC8126 only ensures that the specification is publicly available.  <ins> Despite the following behavior being misguided, experience has shown that some customers use the IANA registry as checklist against which to measure an implementation's completeness and some implementers blindly implement groups supported.  Therefore, IANA [SHALL add/has </ins> added] the following warning to the registry: Cryptographic algorithms and parameters will be broken or weakened The designated expert RFC8126 only ensures that the specification is publicly available. <ins> As specified in RFC8126, assignments made in the Private Use space are not generally useful for broad interoperability.  It is the responsibility of those making use of the Private Use range to ensure that no conflicts occur (within the intended scope of use). For widespread experiments, temporary reservations are available. </ins> ClientCertificateType Identifiers marked as "Yes" are those allocated via Standards Track RFCs.  ClientCertificateTypes marked as "No" are not.


Certificate Types is too strict.  Based on WG consensus, the decision was taken to change registration policy to Specification Required RFC8126 while reserving a small part of the code space for <del> experimental and private use.  Therefore, IANA [SHALL add/has added] a "Recommended" column to the registry.  X.509 and Raw Public Key are "Yes".  All others are "No".  In order to register an extension with the value "Yes", a Standards Track document RFC8126 is REQUIRED. Future Certificate Types MUST define the value of this column.  A Standards Track document RFC8126 is REQUIRED to register an entry with the value "Yes".  IESG Approval is REQUIRED for a Yes->No transition. </del>  See expert-pool for additional information about the designated expert pool.

Looks good
I think the TLS Certificate Type section should explicitly list the values for which "specification required" applies (and for which "reserved for private use" continues to apply).

Certificate Types is too strict.  Based on WG consensus, the decision was taken to change registration policy to Specification Required RFC8126 while reserving a small part of the code space for  <ins> experimental and private use.  Therefore, IANA [SHALL change/has changed] the TLS Certificate Types regisry to: Change the registry policy to: Values with the first byte in the range 0-223 (decimal) are assigned via Specification Required RFC8126.  Values with the first byte 224-255 (decimal) are reserved for Private Use RFC8126. Add a "Recommended" column to the registry.  X.509 and Raw Public Key are "Yes".  All others are "No".  In order to register an extension with the value "Yes", a Standards Track document RFC8126 is REQUIRED.  Future Certificate Types MUST define the value of this column.  A Standards Track document RFC8126 is REQUIRED to register an entry with the value "Yes".  IESG Approval is REQUIRED for a Yes->No transition. </ins> See expert-pool for additional information about the designated expert pool.


IANA [SHALL update/has added] the following notes: <del> Experts are to verify that there is in fact a publicly available specification.  An Internet Draft that is posted and never published or a specification in another standards body, industry consortium, university site, etc. suffices. </del>  As specified in RFC8126, assignments made in the Private Use space are not generally useful for broad interoperability.  It is the IANA [SHALL add/has added] the following notes for additional information: <del> The designated expert RFC8126 only ensures that the specification is publicly available.  An Internet Draft that is posted and never </del>  published or a standard in another standards body, industry <del> consortium, university site, etc. suffices. </del>  As specified in RFC8126, assignments made in the Private Use space are not generally useful for broad interoperability.  It is the has not been through the IETF consensus process, has limited applicability, or is intended only for specific use cases. <del> The designated expert RFC8126 only ensures that the specification is publicly available.  An Internet Draft that is posted and never </del>  published or a standard in another standards body, industry <del> consortium, university site, etc. suffices. </del>  Despite the following behavior being misguided, experience has shown that some customers use the IANA registry as checklist against which IANA [SHALL add/has added] the following notes: <del> The designated expert RFC8126 only ensures that the specification is publicly available.  An Internet Draft that is posted and never </del>  published or a standard in another standards body, industry <del> consortium, university site, etc. suffices. </del>  As specified in RFC8126, assignments made in the Private Use space are not generally useful for broad interoperability.  It is the To provide additional information for the designated experts, IANA [SHALL add/has added] the following note:  The designated expert RFC8126 ensures that the specification is publicly available.  An Internet Draft that is posted and never published or a standard in another standards body, industry <del> consortium, university site, etc. suffices.  The expert also verifies that the label is a string consisting of printable ASCII </del>  characters beginning with "EXPORTER".  IANA MUST also verify that one label is not a prefix of any other label.  For example, labels "key" or "master secretary" are forbidden. IANA [SHALL add/has added] the following note:  Certificate Types marked as "Yes" are those allocated via Standards Track RFCs.  Certificate Types marked as "No" are not.

This change aligns the DE text and adds more info about what the DE does and doesn't do. It also capitalizes "Recommended" so that it's more clear that we're referring to the column. NAME PTAL
LGTM, thanks for unifying the DE language.

IANA [SHALL update/has added] the following notes:  <ins> The role of the designature expert is described in [this-RFC]. The designated expert RFC8126 ensures that the specification is publicly available.  An Internet Draft that is posted and never published or a standard in another standards body, industry consortium, university site, etc. suffices.  The expert may provide more in depth reviews, but their approval should not be taken as an endorsement of the extension. </ins> As specified in RFC8126, assignments made in the Private Use space are not generally useful for broad interoperability.  It is the IANA [SHALL add/has added] the following notes for additional information:  <ins> The role of the designature expert is described in [this-RFC]. The designated expert RFC8126 ensures that the specification is publicly available.  An Internet Draft that is posted and never </ins> published or a standard in another standards body, industry  <ins> consortium, university site, etc. suffices.  The expert may provide more in depth reviews, but their approval should not be taken as an endorsement of the cipher suite. </ins> As specified in RFC8126, assignments made in the Private Use space are not generally useful for broad interoperability.  It is the has not been through the IETF consensus process, has limited applicability, or is intended only for specific use cases.  <ins> The role of the designature expert is described in [this-RFC]. The designated expert RFC8126 ensures that the specification is publicly available.  An Internet Draft that is posted and never </ins> published or a standard in another standards body, industry  <ins> consortium, university site, etc. suffices.  The expert may provide more in depth reviews, but their approval should not be taken as an endorsement of the supported group. </ins> Despite the following behavior being misguided, experience has shown that some customers use the IANA registry as checklist against which IANA [SHALL add/has added] the following notes:  <ins> The role of the designature expert is described in [this-RFC]. The designated expert RFC8126 ensures that the specification is publicly available.  An Internet Draft that is posted and never </ins> published or a standard in another standards body, industry  <ins> consortium, university site, etc. suffices.  The expert may provide more in depth reviews, but their approval should not be taken as an endorsement of the identifier. </ins> As specified in RFC8126, assignments made in the Private Use space are not generally useful for broad interoperability.  It is the To provide additional information for the designated experts, IANA [SHALL add/has added] the following note: <ins> The role of the designature expert is described in [this-RFC]. </ins> The designated expert RFC8126 ensures that the specification is publicly available.  An Internet Draft that is posted and never published or a standard in another standards body, industry  <ins> consortium, university site, etc. suffices.  The expert may provide more in depth reviews, but their approval should not be taken as an endorsement of the exporter.  The expert also verifies that the label is a string consisting of printable ASCII </ins> characters beginning with "EXPORTER".  IANA MUST also verify that one label is not a prefix of any other label.  For example, labels "key" or "master secretary" are forbidden. IANA [SHALL add/has added] the following note: <ins> The role of the designature expert is described in [this-RFC]. The designated expert RFC8126 ensures that the specification is publicly available.  An Internet Draft that is posted and never published or a standard in another standards body, industry consortium, university site, etc. suffices.  The expert may provide more in depth reviews, but their approval should not be taken as an endorsement of the certificate type. The designated expert RFC8126 only ensures that the specification is publicly available.  An Internet Draft that is posted and never published or a standard in another standards body, industry consortium, university site, etc. suffices. </ins> Certificate Types marked as "Yes" are those allocated via Standards Track RFCs.  Certificate Types marked as "No" are not.


RFC5246 and TLS SignatureAlgorithm registries RFC5246: The values in this registry are only applicable to (D)TLS protocol <del> versions prior to 1.3. </del>  [SHALL update/has updated] the "Reference" field in the TLS Compression Method Identifiers, TLS HashAlgorithm and TLS

An open issue was whether to close the HashAlgorithms and SignatureAlgorithms registries or just reserve the values and point to the new 1.3 schemes. WRT opening a closed registry, IANA told me that opening a closed registry required another RFC or if we put in the IANA considerations section IESG Approval. With that info and the fact that at least one person was like "woah wait I might need to register some algorithms for TLS1.2", I don’t really see the point in closing the registry so I propose that we leave it as is, but that we update the text as noted in the PR to explicit point to the SignatureScheme registry.
I think that reserving them is the right thing for now. TLS 1.2 and earlier will take a while to disappear, so the ability to assign more values if there is a huge surprise seems prudent.
NAME PTAL

RFC5246 and TLS SignatureAlgorithm registries RFC5246: The values in this registry are only applicable to (D)TLS protocol  <ins> versions prior to 1.3.  (D)TLS 1.3 and later versions' values are registered in the TLS SignatureScheme registry. </ins> [SHALL update/has updated] the "Reference" field in the TLS Compression Method Identifiers, TLS HashAlgorithm and TLS


The MD5 and SHA-1 hashing algorithms are increasingly vulnerable to attack and this document deprecates their use in TLS 1.2 digital signatures.  However, this document does not deprecate SHA-1 in HMAC <del> for record protection.  This document updates RFC 5246 and RFC 7525. </del>  1. on efficient collision-finding algorithms on the underlying hash constructions Transcript-Collision.  Further, in 2017, researchers from Google and CWI Amsterdam SHA-1-Collision proved SHA-1 collision <del> attacks were practical.  This document updates RFC5246 and RFC7525 in such a way that MD5 and SHA-1 MUST NOT be used for digital signatures.  However, this document does not deprecate SHA-1 in HMAC for record protection.  Note that the CABF has also deprecated use of SHA-1 CABF. </del>  1.1. 7. <del> RFC7525, Recommendations for Secure Use of Transport Layer Security (TLS) and Datagram Transport Layer Security (DTLS), recommends use of SHA-256 as a minimum requirement.  This update moves the minimum recommendation to use stronger language deprecating use of both SHA-1 and MD5.  The prior text did not explicitly include MD5 or SHA-1; and this text adds guidance to ensure that these algorithms have been deprecated. Section 4.3: OLD: When using RSA, servers SHOULD authenticate using certificates with at least a 2048-bit modulus for the public key.  In addition, the use of the SHA-256 hash algorithm is RECOMMENDED (see CAB-Baseline for more details).  Clients SHOULD indicate to servers that they request SHA-256, by using the "Signature Algorithms" extension defined in TLS 1.2. NEW: Servers SHOULD authenticate using certificates with at least a 2048-bit modulus for the public key. In addition, the use of the SHA-256 hash algorithm is RECOMMENDED; and SHA-1 or MD5 MUST NOT be used (see CAB-Baseline for more details).  Clients MUST indicate to servers that they request SHA- 256, by using the "Signature Algorithms" extension defined in TLS 1.2. 8. </del> The document updates the "TLS SignatureScheme" registry to change the recommended status of SHA-1 based signature schemes to N (not recommended) as defined by RFC8447.  The following entries are to be [RFC5246][RFC8447][RFC-to-be] <del> 9. </del>  Concerns with TLS 1.2 implementations falling back to SHA-1 is an issue.  This document updates the TLS 1.2 specification to deprecate support for MD5 and SHA-1 for digital signatures.  However, this document does not deprecate SHA-1 in HMAC for record protection. <del> 10. </del>  The authors would like to thank Hubert Kario for his help in writing the initial draft.  We are also grateful to Daniel Migault, Martin

I didn't add a -08 version of the doc (datatracker keeps that history), and this keeps the diff smaller. cc NAME NAME
Should we remove the 7525 text now that 7525bis is underway.
Could you also: remove the reference to 7525 on line 14 drop 7525 from line 45, i.e., change the header. This I-D will no longer update the 7525. drop "and RFC 7525" line 137. drop "and " from line 158 Like

The MD5 and SHA-1 hashing algorithms are increasingly vulnerable to attack and this document deprecates their use in TLS 1.2 digital signatures.  However, this document does not deprecate SHA-1 in HMAC  <ins> for record protection.  This document updates RFC 5246. </ins> 1. on efficient collision-finding algorithms on the underlying hash constructions Transcript-Collision.  Further, in 2017, researchers from Google and CWI Amsterdam SHA-1-Collision proved SHA-1 collision  <ins> attacks were practical.  This document updates RFC5246 in such a way that MD5 and SHA-1 MUST NOT be used for digital signatures.  However, this document does not deprecate SHA-1 in HMAC for record protection. Note that the CABF has also deprecated use of SHA-1 CABF. </ins> 1.1. 7.  The document updates the "TLS SignatureScheme" registry to change the recommended status of SHA-1 based signature schemes to N (not recommended) as defined by RFC8447.  The following entries are to be [RFC5246][RFC8447][RFC-to-be]  <ins> 8. </ins> Concerns with TLS 1.2 implementations falling back to SHA-1 is an issue.  This document updates the TLS 1.2 specification to deprecate support for MD5 and SHA-1 for digital signatures.  However, this document does not deprecate SHA-1 in HMAC for record protection.  <ins> 9. </ins> The authors would like to thank Hubert Kario for his help in writing the initial draft.  We are also grateful to Daniel Migault, Martin


potential for brute-force attack.  Further, in 2017, researchers from Google and CWI Amsterdam SHA-1-Collision proved SHA-1 collision attacks were practical.  This document updates RFC5246 and RFC7525 in <del> such as way that MD5 and SHA1 MUST NOT be used for digital </del>  signatures.  However, this document does not deprecate SHA-1 in HMAC for record protection.

SHA-1 is spelled everywhere as "SHA-1", it's the only instance of "SHA1" change it so that it is consistent

potential for brute-force attack.  Further, in 2017, researchers from Google and CWI Amsterdam SHA-1-Collision proved SHA-1 collision attacks were practical.  This document updates RFC5246 and RFC7525 in  <ins> such as way that MD5 and SHA-1 MUST NOT be used for digital </ins> signatures.  However, this document does not deprecate SHA-1 in HMAC for record protection.


<del> Deprecating MD5 and SHA-1 signature hashes in TLS 1.2 </del>  draft-ietf-tls-md5-sha1-deprecate-07 Abstract

Addresses , , and .
Replace Deprecating MD5 and SHA-1 signature hashes in TLS 1.2 with Deprecating MD5 and SHA-1 signature hashes in (D)TLS 1.2
Add the following to the WANG reference: URL Replace: URL with URL and URL with URL
replace Dell with CIS/Center for Internet Security (CIS)

<ins> Deprecating MD5 and SHA-1 signature hashes in (D)TLS 1.2 </ins> draft-ietf-tls-md5-sha1-deprecate-07 Abstract


attacks were practical.  This document updates RFC5246 in such a way that MD5 and SHA-1 MUST NOT be used for digital signatures.  However, this document does not deprecate SHA-1 in HMAC for record protection. <del> Note that the CABF has also deprecated use of SHA-1 CABF. </del>  1.1.

We might say that the CABF action was deprecation for use in certificate signatures (not that CABF is likely to be concerned about other uses of SHA1, of course). I don't see much harm in adding "illegal_parameter" to the list of allowed alerts here, as Hubert proposed.  It's otherwise the natural thing to do if an algorithm is received in CertificateVerify that was not advertised in the signature algorithms extension. Sean's proposal at https://mailarchive.ietf.org/arch/msg/tls/rSbXvNPhmr27z0HOBzwv6x0j1mI/ (which makes "illegal_parameter" the only alert) seems like it ought to work.

attacks were practical.  This document updates RFC5246 in such a way that MD5 and SHA-1 MUST NOT be used for digital signatures.  However, this document does not deprecate SHA-1 in HMAC for record protection.  <ins> Note that the CABF has also deprecated use of SHA-1 for use in certificate signatures CABF. </ins> 1.1.


Servers MUST NOT include MD5 and SHA-1 in ServerKeyExchange message. If client does receive a MD5 or SHA-1 signature in the <del> ServerKeyExchange message it MUST abort the connection with handshake_failure or insufficient_security alert. </del>  5.

replying with handshakefailure when server breaks protocol invariants isn't a good idea, make the behaviour conditional on values in signaturealgorithms (since this is the normal behaviour a client should exhibit when a signature algorithm is disabled, this does not actually increase complexity of the implementation)

Servers MUST NOT include MD5 and SHA-1 in ServerKeyExchange message. If client does receive a MD5 or SHA-1 signature in the  <ins> ServerKeyExchange message and it sent one in signature_algorithms extensions it MUST abort the connection with handshake_failure or insufficient_security alert.  If client did not send MD5 nor SHA-1 hash algorithm in signature_algorithms extension and it receives a MD5 or SHA-1 signature in the ServerKeyExchange it MUST abort the connection with the illegal_parameter alert. </ins> 5.


on the underlying hash constructions Transcript-Collision.  Further, in 2017, researchers from Google and CWI Amsterdam SHA-1-Collision proved SHA-1 collision attacks were practical.  This document updates <del> RFC5246 and RFC7525 in such as way that MD5 and SHA-1 MUST NOT be used for digital signatures.  However, this document does not deprecate SHA-1 in HMAC for record protection. </del>  1.1. 2. <del> Clients SHOULD NOT include MD5 and SHA-1 in the signature_algorithms </del>  extension.  If a client does not send a signature_algorithms extension, then the server MUST abort the handshake and send a handshake_failure alert, except when digital signatures are not used 3. Servers SHOULD NOT include MD5 and SHA-1 in CertificateRequest <del> message. </del>  4. <del> Servers MUST NOT include MD5 and SHA-1 in ServerKeyExchange message. If client does receive a MD5 or SHA-1 signature in the ServerKeyExchange message and it sent one in signature_algorithms extensions it MUST abort the connection with handshake_failure or insufficient_security alert.  If client did not send MD5 nor SHA-1 hash algorithm in signature_algorithms extension and it receives a MD5 or SHA-1 signature in the ServerKeyExchange it MUST abort the connection with the illegal_parameter alert. </del>  5. <del> Clients MUST NOT include MD5 and SHA-1 in CertificateVerify message. If the server receives a CertificateVerify message with MD5 or SHA-1 it MUST abort the connection with handshake_failure or </del>  insufficient_security alert. 6.

As per discussion on mailing list.
NAME can you please float this change on the mailing list?

on the underlying hash constructions Transcript-Collision.  Further, in 2017, researchers from Google and CWI Amsterdam SHA-1-Collision proved SHA-1 collision attacks were practical.  This document updates  <ins> RFC5246 and RFC7525 in such a way that MD5 and SHA-1 MUST NOT be used for digital signatures.  However, this document does not deprecate SHA-1 in HMAC for record protection. </ins> 1.1. 2.  <ins> Clients MUST NOT include MD5 and SHA-1 in the signature_algorithms </ins> extension.  If a client does not send a signature_algorithms extension, then the server MUST abort the handshake and send a handshake_failure alert, except when digital signatures are not used 3. Servers SHOULD NOT include MD5 and SHA-1 in CertificateRequest  <ins> messages. </ins> 4.  <ins> Servers MUST NOT include MD5 and SHA-1 in ServerKeyExchange messages. If a client receives a MD5 or SHA-1 signature in a ServerKeyExchange message it MUST abort the connection with the illegal_parameter alert. </ins> 5.  <ins> Clients MUST NOT include MD5 and SHA-1 in CertificateVerify messages. If a server receives a CertificateVerify message with MD5 or SHA-1 it MUST abort the connection with handshake_failure or </ins> insufficient_security alert. 6.


8.  Concerns with TLS 1.2 implementations falling back to SHA-1 is an issue.  This draft updates the TLS 1.2 specification to deprecate support for MD5 and SHA-1 for digital signatures.  However, this document does not deprecate SHA-1 in HMAC for record protection. <del> 9. </del>  The authors would like to thank Hubert Kario for his help in writing the initial draft.  We are also grateful to Daniel Migault, Martin

SHA-1 entries in the signature scheme registry should not be recommended this pull request creates an IANA considerations section to remove the recommended status.
Partially addresses .
Please address the following IDNits: -- The document seems to lack an IANA Considerations section. (See Section 2.2 of URL for how to handle the case when there are no actions for IANA.) -- The draft header indicates that this document updates RFC5246, but the abstract doesn't seem to mention this, which it should. -- The draft header indicates that this document updates RFC7525, but the abstract doesn't seem to mention this, which it should. Section 1. Editorial. -- s/RFC 5246 [RFC5246]/[RFC5246]/ -- s/RFC 6151 [RFC6151]/[RFC6151]/ -- s/RFC7525 [RFC7525]/[RFC7525]/ Section 1. Editorial. For symmetry with the rest of the text: OLD RFC 6151 [RFC6151] details the security considerations, including collision attacks for MD5, published in 2011. NEW In 2011, [RFC6151] detailed the security considerations, including collision attacks for MD5. Section 1. Please provide a reference for "Wang, et al". Is there a reference to provide for the "the potential for brute-force attack" Section 6. Editorial Nit. s/RFC5246 [RFC5246]/[RFC5246]/ Section 6. Move the text "In Section 7.4.1.4.1: the text should be revised from" out of the "OLD" block of text to be its own intro paragraph so that the OLD vs. NEW is a clear cut-and-paste. Section 7. Editorial. s/ RFC7525 [RFC7525]/[RFC7525]/ Section 7. SHA-1 is also not mentioned in RFC7525. Recommend: OLD The prior text did not explicitly include MD5 and this text adds it to ensure it is understood as having been deprecated. NEW The prior text did not explicitly include MD5 or SHA-1; and this text adds guidance to ensure that these algorithms have been deprecated. Section 7. Editorial. Grammar. OLD In addition, the use of the SHA-256 hash algorithm is RECOMMENDED, SHA-1 or MD5 MUST NOT be used NEW In addition, the use of the SHA-256 hash algorithm is RECOMMENDED; and SHA-1 or MD5 MUST NOT be used Section 10.2 Please make RFC5246 a normative reference.
This looks good to merge!

8. <ins> The document updates the "TLS SignatureScheme" registry to change the recommended status of SHA-1 based signature schemes to N (not recommended) as defined by RFC8447.  The following entries are to be updated: Other entries of the resgistry remain the same. 9. </ins> Concerns with TLS 1.2 implementations falling back to SHA-1 is an issue.  This draft updates the TLS 1.2 specification to deprecate support for MD5 and SHA-1 for digital signatures.  However, this document does not deprecate SHA-1 in HMAC for record protection.  <ins> 10. </ins> The authors would like to thank Hubert Kario for his help in writing the initial draft.  We are also grateful to Daniel Migault, Martin


discard any additional tickets.  Servers SHOULD additionally place a limit on the number of tickets they are willing to send, to save resources.  Therefore, the number of NewSessionTicket messages sent <del> will be the minimum of the server's self-imposed limit and </del>  TicketRequestContents.count. Servers that support ticket requests MUST NOT echo "ticket_request"

I don't think any of this paragraph should have 2119 language in it. But, even overlooking that minor disagreement, it's important to avoid unintentional requirements. I think my edit guides well-meaning implementors, while making no guarantees.
This editorial change is fine by me.

discard any additional tickets.  Servers SHOULD additionally place a limit on the number of tickets they are willing to send, to save resources.  Therefore, the number of NewSessionTicket messages sent  <ins> will typically be the minimum of the server's self-imposed limit and </ins> TicketRequestContents.count. Servers that support ticket requests MUST NOT echo "ticket_request"


dispose of pooled tickets after some reasonable amount of time that mimics the ticket rotation period.  Servers that do not enforce a limit on the number of NewSessionTicket messages sent in response to a "ticket_request" extension could leave themselves open to DoS attacks, especially if ticket creation is

Adding the text proposed in the email
Unless I am missing something, I believe that checking the IP address may be useful to filter packets that are outside the key exchange, but I do not see this as a counter measure to the amplification attack. With a single round trip, unless i am missing something, I do not see how the server can verify the Client's IP address. It receives the ClientHello responds with the ServerHello..Finished,NewSessionTickets. In other cases, the server received from the given IP address the ClientHello and the client Finished which I think proves that IP receives the the ServerHello and responds to it. Yours, Daniel
TLS has a cookie extension for this purpose, for example.
Thanks, looks good to me. Yours, Daniel
I agree with the change below and updated the text. OLD: Server should limit the number of NewSessionTicket messages sent in response to a "ticket_request" should be based on the applicability and the amplification factor of such attack. NEW Servers SHOULD limit the number of NewSessionTicket messages they send until they have verified the client's ownership of its IP address.
Great! We're just waiting on NAME
Approved pending Chris' last suggestion

dispose of pooled tickets after some reasonable amount of time that mimics the ticket rotation period. <ins> In some cases, a server may send NewSessionTicket messages immediately upon sending the server Finished message rather than waiting for the client Finished.  If the server has not verified the client's ownership of its IP address, e.g., with the TLS Cookie extension (see RFC8446; Section 4.2.2), an attacker may take advantage of this behavior to create an amplification attack proportional to the count value toward a target by performing a key exchange over UDP with spoofed packets.  Servers SHOULD limit the number of NewSessionTicket messages they send until they have verified the client's ownership of its IP address. </ins> Servers that do not enforce a limit on the number of NewSessionTicket messages sent in response to a "ticket_request" extension could leave themselves open to DoS attacks, especially if ticket creation is


requesting more than one ticket is desirable. Third, we should note that the various tickets in the client's <del> possession ultimately derive from an initial full handshake. </del>  Especially when the client was initially authenticated with a client certificate, that session may need to be refreshed from time to time. <del> Consequently, a server may periodically perform a full handshake even </del>  when the client presents a valid ticket for a session that is too <del> old.  When that happens, it is possible that all tickets derived from the same original session are equally invalid.  A client avoids a full handshake on subsequent connections if it replaces all stored tickets with fresh values.  The number of tickets the server should vend for a full handshake may therefore need to be larger than the number for routine resumption. </del>  This document specifies a new TLS extension - "ticket_request" - that can be used by clients to express their desired number of session following structure: The number of tickets desired by the client when the server <del> chooses to negotiate a fresh session (full handshake), thereby implicitly invalidating all other tickets sharing the same initial session as the presented ticket.  This is also the ticket count requested when the client presented no initial ticket making a full handshake unavoidable. </del>  The number of tickets desired by the client when the server is <del> willing to resume the associated session. </del>  Clients can use the above structure to indicate the number of tickets they would prefer to receive when sessions are resumed or new resumption_count commensurate with the number of parallel sessions would be used.  On the other hand, with e.g. server-to-server traffic with fixed <del> source addresses and no connection racing, ticket reuse may be appropriate.  Clients that wish to reuse tickets when possible should send an extension with the resumption_count set to 0, and the </del>  new_session_count set to the value desired for a full handshake (typically 1). type selected by the server (resumption or full handshake) as clients will most likely discard any additional tickets. <del> When a resumption is performed, and the requested resumption_count is zero, the client is requesting ticket reuse.  If the presented ticket is valid for additional resumptions (only possible when the server supports reuse), it SHOULD return no tickets.  Otherwise, when either the server does not support reuse, or the ticket is expiring, and needs to be replaced (e.g. reissued under a fresh session-ticket encryption key) the server SHOULD return one ticket. </del>  Servers SHOULD additionally place a limit on the number of tickets <del> they are willing to send, to save resources.  Therefore, the number of NewSessionTicket messages sent will typically be the minimum of the server's self-imposed limit and the number requested. </del>  A server that supports ticket requests MAY echo the "ticket_request" extension in the EncryptedExtensions message.  If present, it contains a TicketRequestContents structure, where TicketRequestContents.new_session_count indicates the number of <del> tickets the server expects to send to the client. If the extension is echoed, the TicketRequestContents.resumption_count can be set to a non-zero value to indicate that the server supports ticket reuse, otherwise (i.e. zero) the server does not support ticket reuse.  Ticket reuse has privacy implications and should be used with care or not at all, see the security considerations section. </del>  Servers MUST NOT send the "ticket_request" extension in ServerHello or HelloRetryRequest messages.  A client MUST abort the connection

This improves both happy eyeballs and ticket reuse.
I am significantly skeptical re complexity. The server looks at one counter when resuming and the other when doing a full handshake. Where's the complexity? I am sorry to say that to me personally, the complexity objection sounds rather like reluctance to reconsider the design than a response on the merit.
I still don't think that the additional count is warranted. The rationale here is reasonable, and does provide a degree of justification for the change, but I would prefer not to take on the additional complexity.Thanks for making the updatesThanks for putting this down in writing! I think a separate counter is fine given the rationale, but I disagree with all text on re-use. I think that should happen elsewhere. So, requesting changes for now, though if the WG decides to address ticket re-use here then we will revisit!

requesting more than one ticket is desirable. Third, we should note that the various tickets in the client's  <ins> possession ultimately derive from some initial full handshake. </ins> Especially when the client was initially authenticated with a client certificate, that session may need to be refreshed from time to time.  <ins> Consequently, a server may periodically force a full handshake even </ins> when the client presents a valid ticket for a session that is too  <ins> old.  When that happens, it is possible that any other tickets derived from the same original session are equally invalid.  A client avoids a full handshake on subsequent connections if it replaces all stored tickets with fresh ones obtained from the just performed full handshake.  The number of tickets the server should vend for a full handshake may therefore need to be larger than the number for routine resumption. </ins> This document specifies a new TLS extension - "ticket_request" - that can be used by clients to express their desired number of session following structure: The number of tickets desired by the client when the server  <ins> chooses to negotiate a fresh session (full handshake).  This is also the ticket count requested when the client presented no initial ticket making a full handshake unavoidable. </ins> The number of tickets desired by the client when the server is  <ins> willing to resume using the presented ticket. </ins> Clients can use the above structure to indicate the number of tickets they would prefer to receive when sessions are resumed or new resumption_count commensurate with the number of parallel sessions would be used. <ins> Priming of the ticket cache need not happen all at once.  Clients that anticipate opening frequent connections to a given server can ask for 2 or 3 tickets on each full handshake, and attain the requisite steady-state cache size after a few initial full handshakes, without substantial risk of "overshoot" or need to accurately predict the connection concurrency. When a client presenting a previously obtained ticket finds that the server nevertheless negotiates a fresh session, the client should assume that any other tickets associated with the same session as the presented ticket are also no longer valid for resumption.  This includes not only the tickets obtained during the initial full handshake, but all tickets subsequently obtained as part of subsequent resumptions.  Requesting more than one ticket in case a full handshake is forced by the server helps to keep the session cache primed. </ins> On the other hand, with e.g. server-to-server traffic with fixed  <ins> source addresses and no connection racing, ticket reuse may be an option (ticket reuse is NOT RECOMMENDED per Section C.4 of RFC8446, and is only appropriate when replay and privacy concerns do not apply).  Clients that wish to reuse tickets when possible should send an extension with the resumption_count set to 0, and the </ins> new_session_count set to the value desired for a full handshake (typically 1). type selected by the server (resumption or full handshake) as clients will most likely discard any additional tickets.  <ins> When the client presents a ticket for resumption, but the requested resumption_count is zero and the new_session_count is non-zero, the client is requesting ticket reuse (despite section C.4 of RFC8446). If the presented ticket is valid for additional resumptions (only possible when the server supports reuse), it SHOULD return no tickets.  Otherwise, when either the server does not support reuse, or the ticket is expiring, and needs to be replaced (e.g. reissued under a fresh session-ticket encryption key) the server SHOULD return one ticket. </ins> Servers SHOULD additionally place a limit on the number of tickets  <ins> they are willing to send (whether for full handshakes or resumptions), to save resources.  Therefore, the number of NewSessionTicket messages sent will typically be the minimum of the server's self-imposed limit and the number requested. </ins> A server that supports ticket requests MAY echo the "ticket_request" extension in the EncryptedExtensions message.  If present, it contains a TicketRequestContents structure, where TicketRequestContents.new_session_count indicates the number of  <ins> tickets the server expects to send to the client.  If the extension is echoed, the TicketRequestContents.resumption_count can be set to a non-zero value to indicate that the server supports ticket reuse, otherwise (i.e. zero) the server does not support ticket reuse. Ticket reuse has privacy implications and should be used with care or not at all, see the security considerations section and section C.4 of RFC8446. </ins> Servers MUST NOT send the "ticket_request" extension in ServerHello or HelloRetryRequest messages.  A client MUST abort the connection


As per RFC5077, and as described in RFC8446, TLS servers vend clients an arbitrary number of session tickets at their own discretion in <del> NewSessionTicket messages.  There are two limitations with this design.  First, servers choose some (often hard-coded) number of tickets vended per connection.  Second, clients do not have a way of expressing their desired number of tickets, which can impact future connection establishment.  For example, clients can open multiple TLS connections to the same server for HTTP, or race TLS connections across different network interfaces.  The latter is especially useful in transport systems that implement Happy Eyeballs RFC8305.  Since clients control connection concurrency and resumption, a standard mechanism for requesting more than one ticket is desirable. </del>  This document specifies a new TLS extension - "ticket_request" - that can be used by clients to express their desired number of session for performing connection racing.  The Transport Services Architecture implementation from TAPS also describes how connections can race across interfaces and address families.  In <del> cases where clients have early data to send and want to minimize or avoid ticket re-use, unique tickets for each unique connection attempt are useful.  Moreover, as some servers may implement single-use tickets (and even session ticket encryption keys), distinct tickets will be needed to prevent premature ticket invalidation by racing. </del>  Connection priming: In some systems, connections can be primed or bootstrapped by a centralized service or daemon for faster 3. <del> Clients can indicate to servers their desired number of tickets for a single connection via the following "ticket_request" extension: </del>  Clients MAY send this extension in ClientHello.  It contains the following structure: <del> The number of tickets desired by the client. Clients can use TicketRequestContents.count to indicate the number of tickets they would prefer to receive.  Servers SHOULD NOT send more tickets than TicketRequestContents.count, as clients will most likely discard any additional tickets.  Servers SHOULD additionally place a limit on the number of tickets they are willing to send, to save resources.  Therefore, the number of NewSessionTicket messages sent will typically be the minimum of the server's self-imposed limit and TicketRequestContents.count. A server that supports ticket requests MAY echo the "ticket_request" extension in the EncryptedExtensions message.  If present, it contains a TicketRequestContents structure, where TicketRequestContents.count indicates the number of tickets the server expects to send to the client. </del>  Servers MUST NOT send the "ticket_request" extension in ServerHello or HelloRetryRequest messages.  A client MUST abort the connection If a client receives a HelloRetryRequest, the presence (or absence) of the "ticket_request" extension MUST be maintained in the second ClientHello message.  Moreover, if this extension is present, a <del> client MUST NOT change the value of TicketRequestContents.count in the second ClientHello message. </del>  4. The authors would like to thank David Benjamin, Eric Rescorla, Nick Sullivan, Martin Thomson, Hubert Kario, and other members of the TLS Working Group for discussions on earlier versions of this draft.

This is without ticket re-use text. This also includes changes from . The following table outlines the ticket request values for a a client that wants N tickets and always attempts to race a connection across K paths. Did I get this right? Does this make sense? Should we put this in the document directly?
NAME NAME do you think we should include the table in the PR's description in the text? I think its contents are implied from the text, so adding more text is just being verbose. But I could be persuaded otherwise.
I think that it might be confusing. For instance, I see no reason that a client wouldn't have a fixed configuration. A client that never races resumptions could send N and 1 always.
Can you please provide text?
NAME I can't really provide text as I'm unclear on what the field is trying to even describe.

As per RFC5077, and as described in RFC8446, TLS servers vend clients an arbitrary number of session tickets at their own discretion in  <ins> NewSessionTicket messages.  There are at least three limitations with this design. First, servers vend some (often hard-coded) number of tickets per connection.  Some server implementations return a different default number of tickets for session resumption than for the initial full handshake that created the session.  No static choice, whether fixed, or resumption-dependent is ideal for all situations. Second, clients do not have a way of expressing their desired number of tickets, which can impact future connection establishment.  For example, clients can open multiple TLS connections to the same server for HTTP, or race TLS connections across different network interfaces.  The latter is especially useful in transport systems that implement Happy Eyeballs RFC8305.  Since clients control connection concurrency and resumption, a standard mechanism for requesting more than one ticket is desirable. Third, all tickets in the client's possession ultimately derive from some initial full handshake.  Especially when the client was initially authenticated with a client certificate, that session may need to be refreshed from time to time.  Consequently, a server may periodically force a full handshake even when the client presents a valid ticket.  When that happens, it is possible that any other tickets derived from the same original session are equally invalid. A client avoids a full handshake on subsequent connections if it replaces all stored tickets with fresh ones obtained from the just performed full handshake.  The number of tickets the server should vend for a full handshake may therefore need to be larger than the number for routine resumption. </ins> This document specifies a new TLS extension - "ticket_request" - that can be used by clients to express their desired number of session for performing connection racing.  The Transport Services Architecture implementation from TAPS also describes how connections can race across interfaces and address families.  In  <ins> such cases, clients may use more than one ticket while racing connection attempts in order to establish one successful connection.  Having multiple tickets equips clients with enough tickets to initiate connection racing while avoiding ticket re-use and ensuring that their cache of tickets does not empty during such races.  Moreover, as some servers may implement single-use tickets, distinct tickets prevent premature ticket invalidation by racing. </ins> Connection priming: In some systems, connections can be primed or bootstrapped by a centralized service or daemon for faster 3.  <ins> As discussed in introduction, clients may want different numbers of tickets for fresh or resumed handshakes.  Clients may indicate to servers their desired number of tickets for a single connection, in the case of a full handshake or resumption, via the following "ticket_request" extension: </ins> Clients MAY send this extension in ClientHello.  It contains the following structure:  <ins> The number of tickets desired by the client when the server chooses to negotiate a fresh session (full handshake). The number of tickets desired by the client when the server is willing to resume using the presented ticket. A client starting a fresh connection SHOULD set new_session_count to the desired number of session tickets and resumption_count to 0. Once a client's ticket cache is primed, a resumption_count of 1 is a good choice that allows the server to replace each ticket with a fresh ticket, without over-provisioning the client with excess tickets.  However, clients which race multiple connections and place a separate ticket in each will ultimately end up with just the tickets from a single resumed session.  In that case, clients can send a resumption_count equal to the number of sessions they are attempting in parallel.  (Clients which send a resumption_count less than the number of parallel connection attempts might end up with zero tickets.) When a client presenting a previously obtained ticket finds that the server nevertheless negotiates a fresh session, the client SHOULD assume that any other tickets associated with the same session as the presented ticket are also no longer valid for resumption.  This includes tickets obtained during the initial full handshake and all tickets subsequently obtained as part of subsequent resumptions. Requesting more than one ticket in cases when servers select a full handshake helps keep the session cache primed. Servers SHOULD NOT send more tickets than requested for the handshake type selected by the server (resumption or full handshake). Moreover, servers SHOULD place a limit on the number of tickets they are willing to send, whether for full handshakes or resumptions, to save resources.  Therefore, the number of NewSessionTicket messages sent will typically be the minimum of the server's self-imposed limit and the number requested.  Servers MAY send additional tickets, up to the same limit, if the tickets that are originally sent are somehow invalidated. A server which supports and uses a client "ticket_request" extension MUST also send the "ticket_request" extension in the EncryptedExtensions message.  It contains the following structure: The number of tickets the server expects to send in this connection. </ins> Servers MUST NOT send the "ticket_request" extension in ServerHello or HelloRetryRequest messages.  A client MUST abort the connection If a client receives a HelloRetryRequest, the presence (or absence) of the "ticket_request" extension MUST be maintained in the second ClientHello message.  Moreover, if this extension is present, a  <ins> client MUST NOT change the value of ClientTicketRequest in the second ClientHello message. </ins> 4. The authors would like to thank David Benjamin, Eric Rescorla, Nick Sullivan, Martin Thomson, Hubert Kario, and other members of the TLS Working Group for discussions on earlier versions of this draft. <ins> Viktor Dukhovni contributed text allowing clients to send multiple counts in a ticket request. </ins>


First, servers vend some (often hard-coded) number of tickets per connection.  Some server implementations return a different default <del> number of tickets for session resumption than for the initial full handshake that created the session.  No static choice, whether fixed, or resumption-dependent is ideal for all situations. </del>  Second, clients do not have a way of expressing their desired number of tickets, which can impact future connection establishment.  For <del> example, clients can open multiple TLS connections to the same server </del>  for HTTP, or race TLS connections across different network interfaces.  The latter is especially useful in transport systems that implement Happy Eyeballs RFC8305.  Since clients control connection concurrency and resumption, a standard mechanism for <del> requesting more than one ticket is desirable. </del>  Third, all tickets in the client's possession ultimately derive from <del> some initial full handshake.  Especially when the client was initially authenticated with a client certificate, that session may need to be refreshed from time to time.  Consequently, a server may periodically force a full handshake even when the client presents a valid ticket.  When that happens, it is possible that any other tickets derived from the same original session are equally invalid. A client avoids a full handshake on subsequent connections if it replaces all stored tickets with fresh ones obtained from the just performed full handshake.  The number of tickets the server should vend for a full handshake may therefore need to be larger than the number for routine resumption. </del>  This document specifies a new TLS extension - "ticket_request" - that <del> can be used by clients to express their desired number of session tickets.  Servers can use this extension as a hint for the number of </del>  NewSessionTicket messages to vend.  This extension is only applicable to TLS 1.3 RFC8446, DTLS 1.3 I-D.ietf-tls-dtls13, and future versions of (D)TLS. tickets, distinct tickets prevent premature ticket invalidation by racing. <del> Connection priming: In some systems, connections can be primed or bootstrapped by a centralized service or daemon for faster connection establishment.  Requesting tickets on demand allows such services to vend tickets to clients to use for accelerated handshakes with early data.  (Note that if early data is not needed by these connections, this method SHOULD NOT be used. Fresh handshakes SHOULD be performed instead.) </del> Less ticket waste: Currently, TLS servers use application- specific, and often implementation-specific, logic to determine how many tickets to issue.  By moving the burden of ticket count 3. As discussed in introduction, clients may want different numbers of <del> tickets for fresh or resumed handshakes.  Clients may indicate to </del>  servers their desired number of tickets to receive on a single <del> connection, in the case of a full handshake or resumption, via the </del>  following "ticket_request" extension: Clients MAY send this extension in ClientHello.  It contains the following structure: The number of tickets desired by the client when the server <del> chooses to negotiate a fresh session (full handshake). </del>  The number of tickets desired by the client when the server is willing to resume using a ticket presented in this ClientHello. <del> A client starting a fresh connection SHOULD set new_session_count to </del>  the desired number of session tickets and resumption_count to 0. Once a client's ticket cache is primed, a resumption_count of 1 is a <del> good choice that allows the server to replace each ticket with a fresh ticket, without over-provisioning the client with excess tickets.  However, clients which race multiple connections and place a separate ticket in each will ultimately end up with just the tickets from a single resumed session.  In that case, clients can send a resumption_count equal to the number of sessions they are attempting in parallel.  (Clients which send a resumption_count less than the number of parallel connection attempts might end up with zero tickets.) </del>  When a client presenting a previously obtained ticket finds that the <del> server nevertheless negotiates a fresh session, the client SHOULD </del>  assume that any other tickets associated with the same session as the presented ticket are also no longer valid for resumption.  This <del> includes tickets obtained during the initial full handshake and all </del>  tickets subsequently obtained as part of subsequent resumptions. <del> Requesting more than one ticket in cases when servers select a full handshake helps keep the session cache primed. </del>  <del> Servers SHOULD NOT send more tickets than requested for the handshake type selected by the server (resumption or full handshake). </del>  Moreover, servers SHOULD place a limit on the number of tickets they <del> are willing to send, whether for full handshakes or resumptions, to save resources.  Therefore, the number of NewSessionTicket messages sent will typically be the minimum of the server's self-imposed limit and the number requested.  Servers MAY send additional tickets, up to the same limit, if the tickets that are originally sent are somehow invalidated. </del>  A server which supports and uses a client "ticket_request" extension MUST also send the "ticket_request" extension in the The number of tickets the server expects to send in this connection. <del> Servers MUST NOT send the "ticket_request" extension in ServerHello or HelloRetryRequest messages.  A client MUST abort the connection with an "illegal_parameter" alert if the "ticket_request" extension is present in either of these messages. </del>  If a client receives a HelloRetryRequest, the presence (or absence) of the "ticket_request" extension MUST be maintained in the second encryption keys frequently, clients may be encouraged to obtain and use tickets beyond common lifetime windows of, e.g., 24 hours. Despite ticket lifetime hints provided by servers, clients SHOULD <del> dispose of pooled tickets after some reasonable amount of time that </del>  mimics the session ticket encryption key rotation period.  In some cases, a server may send NewSessionTicket messages immediately upon sending the server Finished message rather than

I opted to go with "new connection" instead of "full handshake" (where appropriate), since that seemed to be the more natural phrase. Please let me know what you think! cc NAME (and thanks for the review!)

First, servers vend some (often hard-coded) number of tickets per connection.  Some server implementations return a different default  <ins> number of tickets for session resumption than for the initial connection that created the session.  No static choice, whether fixed, or resumption-dependent is ideal for all situations. </ins> Second, clients do not have a way of expressing their desired number of tickets, which can impact future connection establishment.  For  <ins> example, clients can open parallel TLS connections to the same server </ins> for HTTP, or race TLS connections across different network interfaces.  The latter is especially useful in transport systems that implement Happy Eyeballs RFC8305.  Since clients control connection concurrency and resumption, a standard mechanism for  <ins> requesting more than one ticket is desirable for avoiding ticket reuse.  See RFC8446, Appendix C.4 for discussion of ticket reuse risks. </ins> Third, all tickets in the client's possession ultimately derive from  <ins> some initial connection.  Especially when the client was initially authenticated with a client certificate, that session may need to be refreshed from time to time.  Consequently, a server may periodically force a new connection even when the client presents a valid ticket. When that happens, it is possible that any other tickets derived from the same original session are equally invalid.  A client avoids a full handshake on subsequent connections if it replaces all stored tickets with new ones obtained from the just performed full handshake.  The number of tickets the server should vend for a new connection may therefore need to be larger than the number for routine resumption. </ins> This document specifies a new TLS extension - "ticket_request" - that  <ins> clients can use to express their desired number of session tickets. Servers can use this extension as a hint for the number of </ins> NewSessionTicket messages to vend.  This extension is only applicable to TLS 1.3 RFC8446, DTLS 1.3 I-D.ietf-tls-dtls13, and future versions of (D)TLS. tickets, distinct tickets prevent premature ticket invalidation by racing.  Less ticket waste: Currently, TLS servers use application- specific, and often implementation-specific, logic to determine how many tickets to issue.  By moving the burden of ticket count 3. As discussed in introduction, clients may want different numbers of  <ins> tickets for new or resumed connections.  Clients may indicate to </ins> servers their desired number of tickets to receive on a single  <ins> connection, in the case of a new or resumed connection, via the </ins> following "ticket_request" extension: Clients MAY send this extension in ClientHello.  It contains the following structure: The number of tickets desired by the client when the server  <ins> chooses to negotiate a new connection. </ins> The number of tickets desired by the client when the server is willing to resume using a ticket presented in this ClientHello.  <ins> A client starting a new connection SHOULD set new_session_count to </ins> the desired number of session tickets and resumption_count to 0. Once a client's ticket cache is primed, a resumption_count of 1 is a  <ins> good choice that allows the server to replace each ticket with a new ticket, without over-provisioning the client with excess tickets. However, clients which race multiple connections and place a separate ticket in each will ultimately end up with just the tickets from a single resumed session.  In that case, clients can send a resumption_count equal to the number of sessions they are attempting in parallel.  (Clients which send a resumption_count less than the number of parallel connection attempts might end up with zero tickets.) </ins> When a client presenting a previously obtained ticket finds that the  <ins> server nevertheless negotiates a new connection, the client SHOULD </ins> assume that any other tickets associated with the same session as the presented ticket are also no longer valid for resumption.  This  <ins> includes tickets obtained during the initial (new) connection and all </ins> tickets subsequently obtained as part of subsequent resumptions.  <ins> Requesting more than one ticket in cases when servers complete a new connection helps keep the session cache primed. </ins>  <ins> Servers SHOULD NOT send more tickets than requested for the connection type selected by the server (new or resumed connection). </ins> Moreover, servers SHOULD place a limit on the number of tickets they  <ins> are willing to send, whether for new or resumed connections, to save resources.  Therefore, the number of NewSessionTicket messages sent will typically be the minimum of the server's self-imposed limit and the number requested.  Servers MAY send additional tickets, typically using the same limit, if the tickets that are originally sent are somehow invalidated. </ins> A server which supports and uses a client "ticket_request" extension MUST also send the "ticket_request" extension in the The number of tickets the server expects to send in this connection.  <ins> Servers MUST NOT send the "ticket_request" extension in any handshake message, including ServerHello or HelloRetryRequest messages.  A client MUST abort the connection with an "illegal_parameter" alert if the "ticket_request" extension is present in any server handshake message. </ins> If a client receives a HelloRetryRequest, the presence (or absence) of the "ticket_request" extension MUST be maintained in the second encryption keys frequently, clients may be encouraged to obtain and use tickets beyond common lifetime windows of, e.g., 24 hours. Despite ticket lifetime hints provided by servers, clients SHOULD  <ins> dispose of cached tickets after some reasonable amount of time that </ins> mimics the session ticket encryption key rotation period. <ins> Specifically, as specified in Section 4.6.1 of RFC8446, clients MUST NOT cache tickets for longer than 7 days. </ins> In some cases, a server may send NewSessionTicket messages immediately upon sending the server Finished message rather than


The ability to request one or more tickets is useful for a variety of purposes: <del> Parallel HTTP connections: To minimize ticket reuse while still improving performance, it may be useful to use multiple, distinct tickets when opening parallel connections.  Clients must therefore bound the number of parallel connections they initiate by the number of tickets in their possession, or risk ticket re-use. </del>  Connection racing: Happy Eyeballs V2 RFC8305 describes techniques for performing connection racing.  The Transport Services computation, e.g., public key cryptographic operations, avoiding waste is desirable. <del> Decline resumption: Clients can indicate they have no intention of resuming connections by sending a ticket request with count of </del>  zero. 3. Clients MAY send this extension in ClientHello.  It contains the following structure: <del> The number of tickets desired by the client when the server chooses to negotiate a new connection. </del>  <del> The number of tickets desired by the client when the server is </del>  willing to resume using a ticket presented in this ClientHello. A client starting a new connection SHOULD set new_session_count to However, clients which race multiple connections and place a separate ticket in each will ultimately end up with just the tickets from a single resumed session.  In that case, clients can send a <del> resumption_count equal to the number of sessions they are attempting in parallel.  (Clients which send a resumption_count less than the number of parallel connection attempts might end up with zero tickets.) </del>  When a client presenting a previously obtained ticket finds that the server nevertheless negotiates a new connection, the client SHOULD

From Ben: One nit that can be rolled in with any LC comments: in Section 3, we say "clients can send a resumption_count equal to the number of sessions they are attempting in parallel", and "connections" probably works better than "sessions" in that case.
Document: draft-ietf-tls-ticketrequests-06 Reviewer: Dale R. Worley Review Date: 2020-11-27 IETF LC End Date: 2020-12-03 IESG Telechat date: Not known Summary: This draft is ready for publication as a Standards Track RFC. Editorial comments: Use Cases Parallel HTTP connections: To minimize ticket reuse while still improving performance, it may be useful to use multiple, distinct tickets when opening parallel connections. To the naive reader, the ordering of the phrases doesn't seem to match the logical ordering of the concepts. Perhaps Parallel HTTP connections: To improve performance, a client may open parallel connections. To avoid ticket reuse, the client may use multiple, distinct tickets on each connection. Decline resumption: Clients can indicate they have no intention of resuming connections by sending a ticket request with count of zero. "have no intention" seems to me to suggest a decision that will not change. Since the future cannot be guaranteed, perhaps better wording is "do not intend to resume", suggesting a current state that might possibly change in the future. newsessioncount The number of tickets desired by the client when the server chooses to negotiate a new connection. resumptioncount The number of tickets desired by the client when the server is willing to resume using a ticket presented in this ClientHello. If I understand the processing which is suggested correctly, when the client sends a ClientHello, the server can choose to either negotiate a new connection, or (if a ticket is present in the ClientHello) the server can choose to resume the previous connection represented by the ticket. These two parameters provide the requested ticket count for the two situations. Assuming the above is correct, I would recommend changing the wording slightly, as "when" suggests a fact which is true over an extended period of time, whereas the provided counts are applicable in just this one instance: newsessioncount The number of tickets desired by the client if the server chooses to negotiate a new connection. resumptioncount The number of tickets desired by the client if the server chooses to resume (using the ticket presented in this ClientHello). (Change "the" to "a" in the last sentence if the ClientHello can present more than one ticket among which the server can choose.)

The ability to request one or more tickets is useful for a variety of purposes:  <ins> Parallel HTTP connections: To improve performance, a client may open parallel connections.  To avoid ticket reuse, the client may use multiple, distinct tickets on each connection.  Clients must therefore bound the number of parallel connections they initiate by the number of tickets in their possession, or risk ticket re- use. </ins> Connection racing: Happy Eyeballs V2 RFC8305 describes techniques for performing connection racing.  The Transport Services computation, e.g., public key cryptographic operations, avoiding waste is desirable.  <ins> Decline resumption: Clients can indicate they do not intend to resume a connection by sending a ticket request with count of </ins> zero. 3. Clients MAY send this extension in ClientHello.  It contains the following structure:  <ins> The number of tickets desired by the client if the server chooses to negotiate a new connection. </ins>  <ins> The number of tickets desired by the client if the server is </ins> willing to resume using a ticket presented in this ClientHello. A client starting a new connection SHOULD set new_session_count to However, clients which race multiple connections and place a separate ticket in each will ultimately end up with just the tickets from a single resumed session.  In that case, clients can send a  <ins> resumption_count equal to the number of connections they are attempting in parallel.  (Clients which send a resumption_count less than the number of parallel connection attempts might end up with zero tickets.) </ins> When a client presenting a previously obtained ticket finds that the server nevertheless negotiates a new connection, the client SHOULD


arbitrary number of session tickets to clients, at their discretion, upon connection establishment.  Clients store and use tickets when resuming future connections.  This document describes a mechanism by <del> which clients may specify the desired number of tickets needed for </del>  future connections.  This extension aims to provide a means for servers to determine the number of tickets to generate in order to reduce ticket waste, while simultaneously priming clients for future 1. <del> As per RFC5077, and as described in RFC8446, TLS servers send clients </del>  an arbitrary number of session tickets at their own discretion in NewSessionTicket messages.  There are two limitations with this design.  First, servers choose some (often hard-coded) number of tickets vended per connection.  Second, clients do not have a way of <del> expressing their desired number of tickets, which may impact future connection establishment.  For example, clients may open multiple TLS connections to the same server for HTTP, or may race TLS connections </del>  across different network interfaces.  The latter is especially useful in transport systems that implement Happy Eyeballs RFC8305.  Since clients control connection concurrency and resumption, a standard mechanism for requesting more than one ticket is desirable. This document specifies a new TLS extension - "ticket_request" - that <del> may be used by clients to express their desired number of session tickets.  Servers may use this extension as a hint of the number of </del>  NewSessionTicket messages to vend.  This extension is only applicable to TLS 1.3 RFC8446, DTLS 1.3 I-D.ietf-tls-dtls13, and future versions thereof. Connection racing: Happy Eyeballs V2 RFC8305 describes techniques for performing connection racing.  The Transport Services Architecture implementation from TAPS also describes how <del> connections may race across interfaces and address families.  In </del>  cases where clients have early data to send and want to minimize or avoid ticket re-use, unique tickets for each unique connection attempt are useful.  Moreover, as some servers may implement distinct tickets will be needed to prevent premature ticket invalidation by racing. <del> Connection priming: In some systems, connections may be primed or </del>  bootstrapped by a centralized service or daemon for faster connection establishment.  Requesting tickets on demand allows such services to vend tickets to clients to use for accelerated Less ticket waste: Currently, TLS servers use application- specific, and often implementation-specific, logic to determine how many tickets to issue.  By moving the burden of ticket count <del> to clients, servers do not generate wasteful tickets for clients. Moreover, as ticket generation may involve expensive computation, e.g., public key cryptographic operations, avoiding waste is desirable. </del>  <del> Decline resumption: Clients may indicate they have no intention of </del>  resuming connections by sending a ticket request with count of zero. 3. <del> Clients may indicate to servers their desired number of tickets for a </del>  single connection via the following "ticket_request" extension: <del> Clients may send this extension in ClientHello.  It contains the </del>  following structure: The number of tickets desired by the client. <del> A supporting server MAY vend TicketRequestContents.count NewSessionTicket messages to a requesting client, and SHOULD NOT send more than TicketRequestContents.count NewSessionTicket messages to a requesting client.  Servers SHOULD place a limit on the number of tickets they are willing to vend to clients.  Thus, the number of NewSessionTicket messages sent should be the minimum of the server's self-imposed limit and TicketRequestContents.count.  Servers MUST NOT send more than 255 tickets to clients. </del>  Servers that support ticket requests MUST NOT echo "ticket_request" in the EncryptedExtensions message.  A client MUST abort the connection with an "illegal_parameter" alert if the "ticket_request" extension is present in the EncryptedExtensions message. <del> Clients MUST NOT change the value of TicketRequestContents.count in second ClientHello messages sent in response to a HelloRetryRequest. </del>  4. dispose of pooled tickets after some reasonable amount of time that mimics the ticket rotation period.  6. The authors would like to thank David Benjamin, Eric Rescorla, Nick <del> Sullivan, Martin Thomson, and other members of the TLS Working Group for discussions on earlier versions of this draft. </del>

If they don't enforce a limit, clients can cause them to do a lot of work.
Fixed by .
Approved pending

arbitrary number of session tickets to clients, at their discretion, upon connection establishment.  Clients store and use tickets when resuming future connections.  This document describes a mechanism by  <ins> which clients can specify the desired number of tickets needed for </ins> future connections.  This extension aims to provide a means for servers to determine the number of tickets to generate in order to reduce ticket waste, while simultaneously priming clients for future 1.  <ins> As per RFC5077, and as described in RFC8446, TLS servers vend clients </ins> an arbitrary number of session tickets at their own discretion in NewSessionTicket messages.  There are two limitations with this design.  First, servers choose some (often hard-coded) number of tickets vended per connection.  Second, clients do not have a way of  <ins> expressing their desired number of tickets, which can impact future connection establishment.  For example, clients can open multiple TLS connections to the same server for HTTP, or race TLS connections </ins> across different network interfaces.  The latter is especially useful in transport systems that implement Happy Eyeballs RFC8305.  Since clients control connection concurrency and resumption, a standard mechanism for requesting more than one ticket is desirable. This document specifies a new TLS extension - "ticket_request" - that  <ins> can be used by clients to express their desired number of session tickets.  Servers can use this extension as a hint of the number of </ins> NewSessionTicket messages to vend.  This extension is only applicable to TLS 1.3 RFC8446, DTLS 1.3 I-D.ietf-tls-dtls13, and future versions thereof. Connection racing: Happy Eyeballs V2 RFC8305 describes techniques for performing connection racing.  The Transport Services Architecture implementation from TAPS also describes how  <ins> connections can race across interfaces and address families.  In </ins> cases where clients have early data to send and want to minimize or avoid ticket re-use, unique tickets for each unique connection attempt are useful.  Moreover, as some servers may implement distinct tickets will be needed to prevent premature ticket invalidation by racing.  <ins> Connection priming: In some systems, connections can be primed or </ins> bootstrapped by a centralized service or daemon for faster connection establishment.  Requesting tickets on demand allows such services to vend tickets to clients to use for accelerated Less ticket waste: Currently, TLS servers use application- specific, and often implementation-specific, logic to determine how many tickets to issue.  By moving the burden of ticket count  <ins> to clients, servers do not generate wasteful tickets.  As an example, clients might only request one ticket during resumption. Moreover, as ticket generation might involve expensive computation, e.g., public key cryptographic operations, avoiding waste is desirable. </ins>  <ins> Decline resumption: Clients can indicate they have no intention of </ins> resuming connections by sending a ticket request with count of zero. 3.  <ins> Clients can indicate to servers their desired number of tickets for a </ins> single connection via the following "ticket_request" extension:  <ins> Clients MAY send this extension in ClientHello.  It contains the </ins> following structure: The number of tickets desired by the client.  <ins> A supporting server MAY use TicketRequestContents.count when determining how many NewSessionTicket messages to send to a requesting client, and SHOULD place a limit on the number of tickets sent.  The number of NewSessionTicket messages sent SHOULD be the minimum of the server's self-imposed limit and TicketRequestContents.count. </ins> Servers that support ticket requests MUST NOT echo "ticket_request" in the EncryptedExtensions message.  A client MUST abort the connection with an "illegal_parameter" alert if the "ticket_request" extension is present in the EncryptedExtensions message.  <ins> If a client receives a HelloRetryRequest, the presence (or absence) of the "ticket_request" extension MUST be maintained in the second ClientHello message.  Moreover, if this extension is present, a client MUST NOT change the value of TicketRequestContents.count in the second ClientHello message. </ins> 4. dispose of pooled tickets after some reasonable amount of time that mimics the ticket rotation period. <ins> Servers that do not enforce a limit on the number of NewSessionTicket messages sent in response to a "ticket_request" extension could leave themselves open to DoS attacks, especially if ticket creation is expensive. </ins> 6. The authors would like to thank David Benjamin, Eric Rescorla, Nick  <ins> Sullivan, Martin Thomson, Hubert Kario, and other members of the TLS Working Group for discussions on earlier versions of this draft. </ins>


Examples of TLS 1.3 handshakes are shown.  Private keys and inputs are provided so that these handshakes might be reproduced. <del> Intermediate values, including secrets, traffic keys and ivs are </del>  shown so that implementations might be checked incrementally against these values. 1. <del> TLS 1.3 TLS13 defines a new key schedule and a number new </del>  cryptographic operations.  This document includes sample handshakes that show all intermediate values.  This allows an implementation to be verified incrementally, examining inputs and outputs of each In this example, the simplest possible handshake is completed.  The server is authenticated, but the client remains anonymous.  After connecting, a few application data octets are exchanged.  The server <del> sends a session ticket that permits the use of 0-RTT in any resumed session. </del>

"IV" is usually capitalized, and a couple of grammar nits. I couldn't figure out what "PRK" meant in the (generated) output; should that be expanded?
I think Sean had tried to clue me in a while ago, but I only just now realized, that it would be nice if this one could be in the same cluster as the core spec, but doing that (basically) requires going through IETF LC/etc. while the test vectors are still for a draft version. So I'd like to kick things off soon and we can see how long it takes. Please do drop a new rev, though; no need to have genart pester us again.

Examples of TLS 1.3 handshakes are shown.  Private keys and inputs are provided so that these handshakes might be reproduced.  <ins> Intermediate values, including secrets, traffic keys and IVs are </ins> shown so that implementations might be checked incrementally against these values. 1.  <ins> TLS 1.3 TLS13 defines a new key schedule and a number of new </ins> cryptographic operations.  This document includes sample handshakes that show all intermediate values.  This allows an implementation to be verified incrementally, examining inputs and outputs of each In this example, the simplest possible handshake is completed.  The server is authenticated, but the client remains anonymous.  After connecting, a few application data octets are exchanged.  The server  <ins> sends a session ticket that permits the use of 0-RTT data in any resumed session. </ins>