Re: http2 opportunistic security negotiation

[Ilari Liusvaara <[e-mail]>]

On Thu, Feb 05, 2015 at 10:08:58AM -0500, Erik Nygren wrote:
> 
> One proposal that came out of some offline discussion would be for clients
> capable of doing HTTP/2 OppSec to always send in the client_hello
> alpn=h2,h2o  (where "h2o" here might be some alpn token for HTTP/2 OppSec
> for HTTP scheme).
> The server would then:
> 
> * Negotiate alpn=h2o with a possibly invalid cert for an HTTP-only
> ServerName/Host
> * Negotiate alpn=h2 with a valid cert for a ServerName/Host supporting HTTPS
> * Return a TLS handshake error ("no cert for this hostname") if neither are
> available  (eg, for HTTP/1.1)
> 
> The downside of this is that the "h2o" server_hello negotiation would be
> in-the-clear in TLS 1.2 (not desirable), although it will be encrypted in
> TLS 1.3.  In true "opportunistic" fashion this may be an acceptable
> trade-off as clients and servers supporting TLS 1.3 will then get the
> additional level of protection over passive eavesdroppers seeing whether
> OppSec was negotiated.

Even TLS 1.3 won't encrypt the ALPN (at least as TLS 1.3 currently is).


-Ilari