<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">
<div class="">
<div style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Menlo;" class="">
<span style="font-variant-ligatures: no-common-ligatures;" class="">Hi,</span></div>
<div style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Menlo; min-height: 13px;" class="">
<span style="font-variant-ligatures: no-common-ligatures;" class=""></span><br class="">
</div>
<div style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Menlo;" class="">
<span style="font-variant-ligatures: no-common-ligatures;" class="">It may be better to have more detail here, rather than refer you to the draft JEP. The first question maybe, if TLS Certificate Compression is something we want it in OpenJDK?</span></div>
</div>
<div class=""><span style="font-variant-ligatures: no-common-ligatures;" class=""><br class="">
</span></div>
<div class="">
<div style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Menlo;" class="">
<span style="font-variant-ligatures: no-common-ligatures;" class="">The TLS Certificate Compression standard was described in RFC 8879, and has been enabled in browser Chrome and Safari. </span>But, what’s TLS Certificate Compression and what’s the benefits
of this feature?</div>
<div style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Menlo; min-height: 13px;" class="">
<span style="font-variant-ligatures: no-common-ligatures;" class=""></span></div>
<div style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Menlo; min-height: 13px;" class="">
<span style="font-variant-ligatures: no-common-ligatures;" class=""></span><br class="">
</div>
<div style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Menlo;" class="">
<span style="font-variant-ligatures: no-common-ligatures;" class="">For TLS connections, a client must authenticate the identity of the server. This typically involves verification that the identity of the server is included in a certificate and that the certificate
is issued by a trusted entity. </span></div>
<div style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Menlo; min-height: 13px;" class="">
<span style="font-variant-ligatures: no-common-ligatures;" class=""></span><br class="">
</div>
<div style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Menlo;" class="">
<span style="font-variant-ligatures: no-common-ligatures;" class="">Where servers provide certificates for authentication, the size of the certificate chain can consume a large number of bytes. Controlling the size of certificate chains is critical to performance
and security in QUIC. TLS certificate compression has the potential to ameliorate the attacks/problems by reducing the size of the handshakes to a size compatible with the security restriction. The TLS Certificate Compression feature is an essential part
for QUIC-TLS protocols.</span></div>
<div style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Menlo;" class="">
<span style="font-variant-ligatures: no-common-ligatures;" class=""><br class="">
</span></div>
<div style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Menlo;" class="">
<span style="font-variant-ligatures: no-common-ligatures;" class="">For more details, please refer to section 4.4 in RFC 9001 (Using TLS to Secure QUIC):</span></div>
<div style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Menlo;" class="">
<span style="font-variant-ligatures: no-common-ligatures;" class="">
<div style="margin: 0px; font-stretch: normal; line-height: normal;" class=""><span style="font-variant-ligatures: no-common-ligatures;" class="">---------</span></div>
<div style="margin: 0px; font-stretch: normal; line-height: normal;" class=""><span style="font-variant-ligatures: no-common-ligatures;" class="">Note: Where servers provide certificates for authentication, the size of the certificate chain can consume a large
number of bytes. Controlling the size of certificate chains is critical to performance in QUIC as servers are limited to sending 3 bytes for every byte received prior to validating the client address; see Section 8.1 of [QUIC-TRANSPORT]. The size of a certificate
chain can be managed by limiting the number of names or extensions; using keys with small public key representations, like ECDSA; or by using certificate compression [COMPRESS].¶</span></div>
<div class=""><span style="font-variant-ligatures: no-common-ligatures;" class="">---------</span></div>
</span></div>
<div style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Menlo;" class="">
<span style="font-variant-ligatures: no-common-ligatures;" class=""><br class="">
</span></div>
<div style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Menlo;" class="">
<span style="font-variant-ligatures: no-common-ligatures;" class="">and a more detailed description in the blog “Does the QUIC handshake require compression to be fast?”(<a href="https://www.fastly.com/blog/quic-handshake-tls-compression-certificates-extension-study" class="">https://www.fastly.com/blog/quic-handshake-tls-compression-certificates-extension-study</a>).
I just copy part of the conclusion section of the bog here for your quick reference. </span></div>
<div style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Menlo;" class="">
<div style="margin: 0px; font-stretch: normal; line-height: normal;" class=""><span style="font-variant-ligatures: no-common-ligatures;" class="">---------</span></div>
<div class=""><span style="font-variant-ligatures: no-common-ligatures;" class="">
<div style="margin: 0px; font-stretch: normal; line-height: normal;" class=""><span style="font-variant-ligatures: no-common-ligatures;" class="">
<div style="margin: 0px; font-stretch: normal; line-height: normal;" class=""><span style="font-variant-ligatures: no-common-ligatures;" class="">First, the TLS certificate compression extension has a very large impact on QUIC performance. Even though the extension
is new and being introduced fairly late in the process when compared to overall QUIC deployment schedules, it seems quite important for both clients and servers to implement the new extension so that the QUIC handshake can live up to its billing. Without some
help, 40% of QUIC full handshakes would be no better than TCP, but compression can repair most of that issue. I have heard of other non-standardized approaches to reducing the size of the certificate chain, and they seem reasonable, but this is a problem worth
addressing immediately with the existing compression extension.</span></div>
<div style="margin: 0px; font-stretch: normal; line-height: normal; min-height: 13px;" class="">
<span style="font-variant-ligatures: no-common-ligatures;" class=""></span><br class="">
</div>
<div style="margin: 0px; font-stretch: normal; line-height: normal;" class="">...</div>
<div style="margin: 0px; font-stretch: normal; line-height: normal;" class=""><span style="font-variant-ligatures: no-common-ligatures;" class=""><br class="">
</span></div>
<div style="margin: 0px; font-stretch: normal; line-height: normal;" class=""><span style="font-variant-ligatures: no-common-ligatures;" class="">Lastly, data from the real world again proves to be more insightful than intuition and is invaluable in making
protocol design and implementation decisions. When I started this work I expected the impact of compression to be positive but marginally focused on a few edge cases. The data shows this optimization lands right on the sweet spot that ties configurations and
the QUIC specification together and impacts a large portion of QUIC handshakes. My thanks to the authors of the compression extension.</span></div>
</span></div>
<div style="margin: 0px; font-stretch: normal; line-height: normal;" class=""><span style="font-variant-ligatures: no-common-ligatures;" class="">---------</span></div>
<div class=""><span style="font-variant-ligatures: no-common-ligatures;" class=""><br class="">
</span></div>
</span></div>
</div>
<div style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Menlo; min-height: 13px;" class="">
<span style="font-variant-ligatures: no-common-ligatures;" class=""></span><br class="">
</div>
<div style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Menlo;" class="">
<span style="font-variant-ligatures: no-common-ligatures;" class="">Besides, reducing the amount of information exchanged during a TLS handshake to a minimum helps to improve performance in environments, for example Inte</span>rnet of Things, where devices
are connected to a network with a low bandwidth and lossy radio technology.</div>
<div style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Menlo; min-height: 13px;" class="">
<span style="font-variant-ligatures: no-common-ligatures;" class=""></span><br class="">
</div>
<div style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Menlo;" class="">
<span style="font-variant-ligatures: no-common-ligatures;" class="">This feature is a part to improve the performance of TLS connections, and it is also a part of the path towards QUIC standards.</span></div>
<div style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Menlo; min-height: 13px;" class="">
<span style="font-variant-ligatures: no-common-ligatures;" class=""></span><br class="">
</div>
<div style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Menlo;" class="">
<span style="font-variant-ligatures: no-common-ligatures;" class="">Chrome support TLS certificate compression with Brotil compression algorithm, and Safari support TLS certificate compression with Zlib compression algorithm.</span></div>
<div style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Menlo; min-height: 13px;" class="">
<span style="font-variant-ligatures: no-common-ligatures;" class=""></span><br class="">
</div>
<div style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Menlo;" class="">
<span style="font-variant-ligatures: no-common-ligatures;" class="">In a summary, JDK could benefits from support RFC 8879 in the following area</span>s:</div>
<div style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Menlo;" class="">
<br class="">
</div>
<div style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Menlo;" class="">
<span style="font-variant-ligatures: no-common-ligatures;" class=""> Performance - Reduce latency and improve performance of TLS and QUIC connections by support the TLS certificate compression standard in JDK.</span></div>
<div style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Menlo;" class="">
<span style="font-variant-ligatures: no-common-ligatures;" class=""> Security - Mitigate the impact of amplification attacks threat by reducing the size of the TLS handshakes with compressed certificates.</span></div>
<div class=""><span style="font-family: Menlo; font-size: 11px;" class=""><br class="">
</span></div>
<div class=""><font face="Menlo" class=""><span style="font-size: 11px;" class="">Please feel free to share you comments, if it is something we want in OpenJDK?</span></font></div>
<div class=""><span style="font-family: Menlo; font-size: 11px;" class=""><br class="">
</span></div>
<div class=""><span style="font-family: Menlo; font-size: 11px;" class="">Thanks,</span></div>
<div class=""><span style="font-family: Menlo; font-size: 11px;" class="">Xuelei</span></div>
</div>
<div class=""><span style="font-family: Menlo; font-size: 11px;" class=""><br class="">
</span></div>
<div><br class="">
<blockquote type="cite" class="">
<div class="">On Feb 28, 2022, at 10:57 AM, xueleifan(XueleiFan) <<a href="mailto:xueleifan@tencent.com" class="">xueleifan@tencent.com</a>> wrote:</div>
<br class="Apple-interchange-newline">
<div class="">
<div style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">
Hi,
<div class=""><br class="">
</div>
<div class="">Could I have this JEP reviewed? One or more qualified Committers review is required to move it forward.</div>
<div class=""><br class="">
</div>
<div class="">Here is the PR if you want to have a further look at the implementation and test:</div>
<div class=""> <a href="https://github.com/openjdk/jdk/pull/7599" class="">https://github.com/openjdk/jdk/pull/7599</a></div>
<div class=""><br class="">
</div>
<div class="">Thanks,</div>
<div class="">Xuelei<br class="">
<div class=""><br class="">
<blockquote type="cite" class="">
<div class="">On Feb 15, 2022, at 9:30 PM, xueleifan(XueleiFan) <<a href="mailto:xueleifan@tencent.com" class="">xueleifan@tencent.com</a>> wrote:</div>
<br class="Apple-interchange-newline">
<div class="">
<div style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">
Hi all,
<div class=""><br class="">
</div>
<div class="">The JDK Enhancement Proposal, TLS Certificate Compression, has been opened for community review. Detailed, please refer to the draft:</div>
<div class=""><br class="">
</div>
<div class=""> <a href="https://bugs.openjdk.java.net/browse/JDK-8281710" class="">
https://bugs.openjdk.java.net/browse/JDK-8281710</a></div>
<div class=""><br class="">
</div>
<div class="">Feel free to make comment and send your feedback to the alias. I may submit this JEP in the beginning of next week if I hear no objections by the end of this week.</div>
<div class=""><br class="">
</div>
<div class="">Thanks,</div>
<div class="">Xuelei</div>
<div class=""><br class="">
</div>
</div>
</div>
</blockquote>
</div>
<br class="">
</div>
</div>
</div>
</blockquote>
</div>
<br class="">
</body>
</html>