Re: [apps-discuss] For consideration as an appsawg document: draft-hoffman-server-has-tls-03.txt

I have had a look at this, and have three questions:

1. Have I understood it correct if the client by using this RR can refuse to fall back to insecure connection for "communication using HTTP"? I.e. it seems the RR is specifying whether fallback is possible to not only per port, which works when you have "STARTTLS" or similar, but not when fallback is between ports?

2. If so, the "input" to the query should in that case be not only the hostname, but the protocol and hostname, right? So one could use a prefix-based mechanism like _http._tcp.example.com. IN HASTLS 0 443 0

3. I am always a bit nervous over RDATA that has variable length. Do you have an implementation of this so that you have tried to ensure "it works"?

Otherwise, as someone said, overall negotiation I think is interesting.

   Patrik

On 17 jan 2011, at 03.41, Paul Hoffman wrote:

> Greetings again. I would like this WG to consider adopting the following draft as a WG item. It is definitely apps-related, and there is no other appropriate WG in the Applications or Security areas for it. It has been discussed in the websec WG, but that WG is limited to HTTP only (and this document covers TLS for all application protocols).
> 
> FWIW, some of the topics in this draft are quite open for active discussion. The discussion in websec brought up some interesting issues, but they got discussed in the HTTP context only, and this WG would be a better place to discuss them for all server protocols.
> 
> --Paul Hoffman
> 
> A New Internet-Draft is available from the on-line Internet-Drafts directories.
> 
> 	Title           : Specifying That a Server Supports TLS
> 	Author(s)       : P. Hoffman
> 	Filename        : draft-hoffman-server-has-tls-03.txt
> 	Pages           : 8
> 	Date            : 2011-01-16
> 
> A server that hosts applications that can be run with or without TLS
> may want to communicate with clients whether the server is hosting an
> application only using TLS or also hosting the application without
> TLS.  Many clients have a policy to try to set up a TLS session but
> fall back to insecure if the TLS session cannot be set up.  If the
> server can securely communicate whether or not it can fall back to
> insecure tells such a client whether or not they should even try to
> set up an insecure session with the server.  This document describes
> the use cases for this type of communication and a secure method for
> communicating that information.
> 
> A URL for this Internet-Draft is:
> http://www.ietf.org/internet-drafts/draft-hoffman-server-has-tls-03.txt
> _______________________________________________
> apps-discuss mailing list
> apps-discuss@ietf.org
> https://www.ietf.org/mailman/listinfo/apps-discuss
> 