Re: Fwd: New Version Notification for draft-nottingham-http2-encryption-03.txt

["Martin Nilsson" <[e-mail]>]

So some thoughts on this from a proxy point of view.

#1 As a transparent proxy you could observe a client make a request, get  
an alt-svc header in the response, and then see the client make another  
clear text request. The proxy could at that point make a TLS connection  
between the proxy and destination server.

#2 As a transparent proxy you could observe a client make a request, get  
an response lacking alt-svc, and inject one to get the client to connect  
through TLS to the proxy (given client support). The proxy needs a way to  
distinguish between these TLS connections and "real" (opportunistic or  
https-initiated) TLS connections from the client, which currently can only  
be done by picking a differnt port that is unlikely (or probed not) to be  
in use. It would mess with alt-svc caching however.

If increasing the feet of encrypted cables is a goal, then both of these  
scenarios should be valid.

/Martin Nilsson

On Tue, 20 May 2014 05:42:50 +0200, Mark Nottingham <[e-mail]> wrote:

> FYI - Martin went away and did some substantial revision of this draft,  
> and is now an author.
>
> Regards,
>
>
> Begin forwarded message:
>
>> From: [e-mail]
>> Subject: New Version Notification for  
>> draft-nottingham-http2-encryption-03.txt
>> Date: 20 May 2014 1:40:54 pm AEST
>> To: "Mark Nottingham" <[e-mail]>, Martin Thomson  
>> <[e-mail]>, "Martin Thomson"  
>> <[e-mail]>, Mark Nottingham <[e-mail]>
>>
>>
>> A new version of I-D, draft-nottingham-http2-encryption-03.txt
>> has been successfully submitted by Mark Nottingham and posted to the
>> IETF repository.
>>
>> Name:		draft-nottingham-http2-encryption
>> Revision:	03
>> Title:		Opportunistic Encryption for HTTP URIs
>> Document date:	2014-05-20
>> Group:		Individual Submission
>> Pages:		9
>> URL:             
>> http://www.ietf.org/internet-drafts/draft-nottingham-http2-encryption-03.txt
>> Status:          
>> https://datatracker.ietf.org/doc/draft-nottingham-http2-encryption/
>> Htmlized:        
>> http://tools.ietf.org/html/draft-nottingham-http2-encryption-03
>> Diff:            
>> http://www.ietf.org/rfcdiff?url2=draft-nottingham-http2-encryption-03
>>
>> Abstract:
>>   This describes how "http" URIs can be accessed using Transport Layer
>>   Security (TLS) to mitigate pervasive monitoring attacks.
>>
>>
>>
>>
>> Please note that it may take a couple of minutes from the time of  
>> submission
>> until the htmlized version and diff are available at tools.ietf.org.
>>
>> The IETF Secretariat
>>
>
> --
> Mark Nottingham   http://www.mnot.net/
>
>
>
>


-- 
Using Opera's revolutionary email client: http://www.opera.com/mail/