Re: 9.2.2 Cipher fallback and FF<->Jetty interop problem

Willy Tarreau <w@1wt.eu> Fri, 19 September 2014 06:13 UTC

Resent-Date: Fri, 19 Sep 2014 06:11:45 +0000
Resent-Message-Id: <E1XUrQ1-0007sL-QE@frink.w3.org>
Date: Fri, 19 Sep 2014 08:11:03 +0200
From: Willy Tarreau <w@1wt.eu>
To: Roland Zink <roland@zinks.de>
Cc: ietf-http-wg@w3.org
Message-ID: <20140919061103.GC13993@1wt.eu>
References: <CAH_y2NF+sP9BmYuD4QbeHpwC_uj67itzaAFCnRVC6f--KDYOgg@mail.gmail.com> <CAOdDvNopynmwvwWLXvuC0q7skunFXcfRoVHe9s7BKcoCwaBgWQ@mail.gmail.com> <CAH_y2NGXz7e3ejqy_rD=39=yYp3+cS1Dm6c3yFEYZg6tsUp5VQ@mail.gmail.com> <CABkgnnWAdm1TLP2XCKNU-6RPACLfooQV73R7Gpoemv+9PNULCA@mail.gmail.com> <CAH_y2NFLjok-NRJtOw1vmSy68sf393iSOgA4K599q0BSBqbNgA@mail.gmail.com> <CABkgnnU-CMtv8KvYU9n+QoPBOBshtQv3RfLy2qw=qVNb2O-qGg@mail.gmail.com> <CAH_y2NHrbH5Objwhq9E89QexhQtND4uOdy8q7OEckTCU17WqKg@mail.gmail.com> <CAH_y2NErRd4rxinSzEH3-uTjdWVkZu9o6sSKSf47LxfPFTRONw@mail.gmail.com> <54194A22.5010000@zinks.de>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Disposition: inline
In-Reply-To: <54194A22.5010000@zinks.de>
User-Agent: Mutt/1.4.2.3i
Received-SPF: pass client-ip=62.212.114.60; envelope-from=w@1wt.eu; helo=1wt.eu
Subject: Re: 9.2.2 Cipher fallback and FF<->Jetty interop problem
Archived-At: <http://www.w3.org/mid/20140919061103.GC13993@1wt.eu>
Resent-From: ietf-http-wg@w3.org
Resent-Sender: ietf-http-wg-request@w3.org
Precedence: list

On Wed, Sep 17, 2014 at 10:45:22AM +0200, Roland Zink wrote:
> So how are new ciphers added later? Does this require a new HTTP2 RFC, 
> or a new TLS RFC or do they need to be registered with IANA? What if one 
> of the now acceptable ciphers is no longer considered secure and should 
> be disabled?

Simple response : it will not be possible to upgrade them anymore because
servers will have to change their cipher suite and become suddenly
incompatible with already deployed browsers. Updating the spec does not
mean upgrading all implementations at once... And advertising a new ALPN
name will not mean that servers will be able to propose a different cipher
suite depending on what protocol version is selected.

> Doesn't this cipher selection belong into TLS and not h2?

Sure!

Willy

9.2.2 Cipher fallback and FF<->Jetty interop prob… Greg Wilkins
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Greg Wilkins
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Eric Rescorla
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Greg Wilkins
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Martin Thomson
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Simone Bordet
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Greg Wilkins
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Patrick McManus
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Simone Bordet
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Patrick McManus
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Patrick McManus
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Michael Sweet
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Michael Sweet
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Martin Thomson
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Michael Sweet
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Simone Bordet
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Martin Thomson
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Eric Rescorla
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Michael Sweet
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Martin Thomson
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Greg Wilkins
RE: 9.2.2 Cipher fallback and FF<->Jetty interop … Andrei Popov
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Brian Smith
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Michael Sweet
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Michael Sweet
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Brian Smith
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Martin Thomson
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Eric Rescorla
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Martin Thomson
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Greg Wilkins
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Martin Thomson
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Greg Wilkins
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Greg Wilkins
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Amos Jeffries
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Greg Wilkins
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Ilari Liusvaara
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Brian Smith
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Cory Benfield
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Roland Zink
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Greg Wilkins
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Brian Smith
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Greg Wilkins
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Martin Thomson
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Greg Wilkins
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Stuart Douglas
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Greg Wilkins
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Cory Benfield
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Roland Zink
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Greg Wilkins
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Patrick McManus
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Roy T. Fielding
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Simone Bordet
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Simone Bordet
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Roy T. Fielding
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Jason Greene
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Ilari Liusvaara
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Greg Wilkins
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Stuart Douglas
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Willy Tarreau
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Willy Tarreau
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Willy Tarreau
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Cory Benfield
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Stuart Douglas
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Amos Jeffries
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Cory Benfield
RE: 9.2.2 Cipher fallback and FF<->Jetty interop … Andrei Popov
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Ilari Liusvaara
RE: 9.2.2 Cipher fallback and FF<->Jetty interop … Andrei Popov
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Roy T. Fielding
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Eric Rescorla
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Jim Manico
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Jason Greene
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Eric Rescorla
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Jason Greene
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Eric Rescorla
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Jason Greene
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Simone Bordet
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Greg Wilkins
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Mark Nottingham
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Greg Wilkins
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Jason Greene
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Patrick McManus
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Greg Wilkins
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Willy Tarreau
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Martin Thomson
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Eric Rescorla
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Eric Rescorla
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Eric Rescorla
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Eric Rescorla
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Martin Thomson
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Eric Rescorla
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Willy Tarreau
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Julian Reschke
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Martin Thomson
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Martin Thomson
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Roland Zink
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Michael Sweet
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Eric Rescorla
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Simone Bordet
RE: 9.2.2 Cipher fallback and FF<->Jetty interop … Andrei Popov
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Greg Wilkins
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Jason Greene
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Greg Wilkins
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Eric Rescorla
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Eric Rescorla
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Greg Wilkins
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Martin Thomson
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Eric Rescorla
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Martin Thomson
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Amos Jeffries
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Roland Zink
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Roland Zink
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Eric Rescorla
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Roland Zink
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Simone Bordet
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Martin Thomson
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Roland Zink
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Martin Thomson
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Simone Bordet
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Roland Zink
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Martin Thomson
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Simone Bordet
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Amos Jeffries
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Stuart Douglas
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Martin Thomson
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Roland Zink
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Simone Bordet
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Michael Sweet
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Michael Sweet
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Eric Rescorla
RE: 9.2.2 Cipher fallback and FF<->Jetty interop … Andrei Popov
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … Martin Thomson
RE: 9.2.2 Cipher fallback and FF<->Jetty interop … Rob Trace
Re: 9.2.2 Cipher fallback and FF<->Jetty interop … John Mattsson