Re: HTTPBis Call For Adoption: Using Early Data in HTTP [aka Replay]

On 08/09/2017 10:25 AM, Patrick McManus wrote:
>
> https://www.ietf.org/internet-drafts/draft-thomson-http-replay-01.txt
> <https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_internet-2Ddrafts_draft-2Dthomson-2Dhttp-2Dreplay-2D01.txt&d=DwMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=sssDLkeEEBWNIXmTsdpw8TZ3tAJx-Job4p1unc7rOhM&m=uPvTnvjSvjqcivpFpYiq9O7yv6M0XprTPGi_Jy-dAuQ&s=sAf9tHbal7GzGYC9N-JmdYTxwOcn951kZeNsIpzPEYo&e=>
>
> We've been discussing the risks of algorithms around early data both
> on the list and face to face recently in Prague. This draft from
> Martin, Wily, and Mark has obviously been the nexus of that
> conversation and the group informally signaled support for adding it
> as a working group item during the recent meeting.
>
> Please state whether you support adoption, and ideally why.
> Expressions of interest in implementation would also be very helpful.

I support adopting this document -- HTTP is perhaps the biggest
potential use case for TLS 1.3 early-data, and it would be good to have
an application profile ready for implementors along with the final TLS
1.3 specification.  This document has had a lot of analysis go into it
already, and
seems to reflect the necessary properties and implementation behavior
(or nearly so) as far as we can tell so far.

-Ben