Re: 9.2.2 Cipher fallback and FF<->Jetty interop problem

Stuart Douglas <stuart.w.douglas@gmail.com> Fri, 19 September 2014 06:34 UTC

Resent-Date: Fri, 19 Sep 2014 06:32:43 +0000
Resent-Message-Id: <E1XUrkJ-00043P-M9@frink.w3.org>
Message-ID: <541BCDD7.1010100@gmail.com>
Date: Fri, 19 Sep 2014 16:31:51 +1000
From: Stuart Douglas <stuart.w.douglas@gmail.com>
User-Agent: Postbox 3.0.11 (Macintosh/20140602)
MIME-Version: 1.0
To: Willy Tarreau <w@1wt.eu>
CC: Cory Benfield <cory@lukasa.co.uk>, Greg Wilkins <gregw@intalio.com>, Martin Thomson <martin.thomson@gmail.com>, Brian Smith <brian@briansmith.org>, Ilari Liusvaara <ilari.liusvaara@elisanet.fi>, HTTP Working Group <ietf-http-wg@w3.org>
References: <CAH_y2NErRd4rxinSzEH3-uTjdWVkZu9o6sSKSf47LxfPFTRONw@mail.gmail.com> <20140917073241.GA7665@LK-Perkele-VII> <CAFewVt4pxE+9NpzYuzMKGmEdrDXzk50mC99ZbrM6M-uEoKXrHA@mail.gmail.com> <CAH_y2NGYcDvPcxDvaTRBP3p4Pnb7gw39WUDY3bNVnOGQjBgciQ@mail.gmail.com> <CAFewVt7+UAJYfKAR6DRZi_mqdzSaYw6L-pT1qg=UyOaP1ojhTw@mail.gmail.com> <CAH_y2NEhAEaPiUgi_vX6Oimw+Y-k3WrnL0gJZKPxQ8KZVuFVfw@mail.gmail.com> <CABkgnnU6C+TzJzdeQZhwXucuPUrPh1yyp1cpRd9jSePMjAnONQ@mail.gmail.com> <541A653C.4050903@gmail.com> <CAH_y2NFKqH8HGfXk0VR2BZ3n1vKPXeQkM0-qVjGhnz_TFGAwew@mail.gmail.com> <CAH_hAJHrhY1nQAHQ_o0uVPuqccLDzYAyNEuZ6q1Dh4ePDBKA_A@mail.gmail.com> <20140919060809.GB13993@1wt.eu>
In-Reply-To: <20140919060809.GB13993@1wt.eu>
Content-Type: text/plain; charset="ISO-8859-1"; format="flowed"
Content-Transfer-Encoding: 7bit
Received-SPF: pass client-ip=209.85.192.171; envelope-from=stuart.w.douglas@gmail.com; helo=mail-pd0-f171.google.com
Subject: Re: 9.2.2 Cipher fallback and FF<->Jetty interop problem
Archived-At: <http://www.w3.org/mid/541BCDD7.1010100@gmail.com>
Resent-From: ietf-http-wg@w3.org
Resent-Sender: ietf-http-wg-request@w3.org
Precedence: list

>
> Just like Roy, I won't implement any such control and will leave it to
> the admin to configure the proper ciphers for this, because this is the
> correct thing to do.

For what it is worth I also won't be implementing this in 
Undertow/Wildfly, and leaving it up to the admin to control the allowed 
cyphers. If this unfortunate clause does make it into the final spec 
then I may introduce some kind of strict option that makes a best effort 
guess as to what protocols should be allowed (which on Java 7 will be zero).

Another thing I really don't like about this section that Greg has 
already alluded to is that is assumes that 
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 will remain a strong and unbroken 
cypher for the life of the HTTP2 spec. If this spec has anywhere near 
the longevity of HTTP1 there is a non zero chance this will not be true.

Stuart

>
> Willy
>

9.2.2 Cipher fallback and FF<->Jetty interop prob… Greg Wilkins
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Greg Wilkins
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Eric Rescorla
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Greg Wilkins
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Martin Thomson
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Simone Bordet
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Greg Wilkins
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Patrick McManus
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Simone Bordet
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Patrick McManus
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Patrick McManus
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Michael Sweet
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Michael Sweet
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Martin Thomson
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Michael Sweet
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Simone Bordet
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Martin Thomson
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Eric Rescorla
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Michael Sweet
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Martin Thomson
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Greg Wilkins
RE: 9.2.2 Cipher fallback and FF<->Jetty interop … Andrei Popov
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Brian Smith
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Michael Sweet
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Michael Sweet
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Brian Smith
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Martin Thomson
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Eric Rescorla
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Martin Thomson
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Greg Wilkins
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Martin Thomson
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Greg Wilkins
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Greg Wilkins
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Amos Jeffries
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Greg Wilkins
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Ilari Liusvaara
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Brian Smith
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Cory Benfield
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Roland Zink
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Greg Wilkins
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Brian Smith
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Greg Wilkins
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Martin Thomson
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Greg Wilkins
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Stuart Douglas
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Greg Wilkins
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Cory Benfield
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Roland Zink
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Greg Wilkins
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Patrick McManus
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Roy T. Fielding
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Simone Bordet
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Simone Bordet
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Roy T. Fielding
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Jason Greene
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Ilari Liusvaara
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Greg Wilkins
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Stuart Douglas
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Willy Tarreau
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Willy Tarreau
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Willy Tarreau
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Cory Benfield
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Stuart Douglas
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Amos Jeffries
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Cory Benfield
RE: 9.2.2 Cipher fallback and FF<->Jetty interop … Andrei Popov
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Ilari Liusvaara
RE: 9.2.2 Cipher fallback and FF<->Jetty interop … Andrei Popov
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Roy T. Fielding
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Eric Rescorla
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Jim Manico
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Jason Greene
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Eric Rescorla
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Jason Greene
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Eric Rescorla
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Jason Greene
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Simone Bordet
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Greg Wilkins
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Mark Nottingham
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Greg Wilkins
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Jason Greene
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Patrick McManus
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Greg Wilkins
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Willy Tarreau
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Martin Thomson
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Eric Rescorla
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Eric Rescorla
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Eric Rescorla
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Eric Rescorla
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Martin Thomson
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Eric Rescorla
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Willy Tarreau
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Julian Reschke
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Martin Thomson
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Martin Thomson
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Roland Zink
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Michael Sweet
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Eric Rescorla
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Simone Bordet
RE: 9.2.2 Cipher fallback and FF<->Jetty interop … Andrei Popov
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Greg Wilkins
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Jason Greene
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Greg Wilkins
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Eric Rescorla
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Eric Rescorla
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Greg Wilkins
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Martin Thomson
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Eric Rescorla
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Martin Thomson
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Amos Jeffries
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Roland Zink
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Roland Zink
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Eric Rescorla
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Roland Zink
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Simone Bordet
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Martin Thomson
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Roland Zink
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Martin Thomson
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Simone Bordet
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Roland Zink
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Martin Thomson
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Simone Bordet
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Amos Jeffries
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Stuart Douglas
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Martin Thomson
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Roland Zink
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Simone Bordet
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Michael Sweet
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Michael Sweet
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Eric Rescorla
RE: 9.2.2 Cipher fallback and FF<->Jetty interop … Andrei Popov
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Martin Thomson
RE: 9.2.2 Cipher fallback and FF<->Jetty interop … Rob Trace
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … John Mattsson