Subject: [quicwg/base-drafts] Ben Kaduk's TLS Comment 3 (#4479)

From: Lucas Pardue <[email-masked]>
Date: Tue, 05 Jan 2021 18:48:35 -0800

@kaduk said:

> Section 3
> 
> Figure 3 shows "TLS Alerts" as being carried over QUIC Transport, but
> per §4.8 TLS alerts are translated into QUIC connection errors and are
> not sent natively.
> 
>    *  The TLS component provides a series of updates to the QUIC
>       component, including (a) new packet protection keys to install (b)
>       state changes such as handshake completion, the server
>       certificate, etc.
> 
> I think that if we're going to talk about passing the server certificate
> between TLS and QUIC components, we should be very clear about where/how
> certificate validation occurs.  For example, it would be pretty
> disasterous if TLS passed the certificate to QUIC expecting that QUIC
> would do any validation of the peer identity, but QUIC assumed that TLS
> would only provide a validated certificate.  Perhaps in §4.1 when we
> mention the potential for "additional functions [...] to configure TLS",
> we might mention "including certificate validation", if appropriate?

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/4479

---

From: Martin Thomson <[email-masked]>
Date: Wed, 06 Jan 2021 22:54:54 -0800

Closed #4479 via #4553.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/4479#event-4178464048

---

From: kaduk <[email-masked]>
Date: Fri, 08 Jan 2021 21:59:52 -0800

Should we split this bit out into a separate issue?

(The prose also says "TLS Handshake and Alert messages are carried
directly over the QUIC transport".)

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/4479#issuecomment-757102578

---

From: Martin Thomson <[email-masked]>
Date: Sun, 10 Jan 2021 17:56:01 -0800

I don't think we need to do anything in response to that.  Those messages are carried by QUIC.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/4479#issuecomment-757587520

---

From: kaduk <[email-masked]>
Date: Sun, 10 Jan 2021 22:33:18 -0800

I will defer to your preference, but I do not agree that "those messages" are carried by QUIC; QUIC does not carry TLS Alert structures.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/4479#issuecomment-757653269