Re: [hybi] WebSocket, TLS and intermediaries

[Mike Belshe <[e-mail]>]

On the TLS issue, we're going in circles.  Both sides are correct on the
facts about the pros and cons of TLS (more or less).  I don't think the spec
should require TLS.  But, would it be possible to define alternate
handshakes based on whether TLS is used?

If we use the currently defined handshake, TLS will be at a performance
disadvantage to insecure WebSockets, because TLS will require more
round-trips.

Could we define, as part of the WebSocket protocol, that when WebSocket is
negotiated over TLS it uses the TLS/NPN extension to effectively fold the
WebSocket Upgrade handshake into the TLS handshake?  This removes a round
trip from the WebSocket startup time.  The next-protocol-negotiation
extension is defined here:
http://tools.ietf.org/html/draft-agl-tls-nextprotoneg-00

If we don't do this, websites in the future will be discouraged from using
secure websockets because secure websockets will be slower than insecure
ones.  By contrast, with the improvements in TLS (if they come to fruition),
if WebSockets defines a mechanism for hanshaking over TLS/NPN, WebSockets
over TLS will negotiate with fewer round trips than WebSockets over HTTP.
 Hopefully this will encourage more use of the secure facility, without
making it a requirement for those that really don't want it.
<http://tools.ietf.org/html/draft-agl-tls-nextprotoneg-00>
Mike

On Wed, Jul 21, 2010 at 3:47 PM, Ian Hickson <[e-mail]> wrote:

> On Wed, 21 Jul 2010, Maciej Stachowiak wrote:
> >
> > In my opinion, to the extent we support intermediaries, the design
> > should require at least one of the client or server to be explicitly
> > aware of the intermediary.
>
> Agreed. I think we should add this to the requirements.
>
>
> > We should not support magical transparent intermediaries where neither
> > the client nor server has an obvious way to detect its existence; in
> > fact we should design the protocol to prevent such intermediaries from
> > being created.
>
> The only way I can see to do this would be to require TLS (or some
> equivalent asymmetric encryption scheme), which I think is too high a
> cost. Otherwise, in principle, I agree with this too.
>
> --
> Ian Hickson               U+1047E                )\._.,--....,'``.    fL
> http://ln.hixie.ch/       U+263A                /,   _.. \   _\  ;`._ ,.
> Things that are impossible just take longer.   `._.-(,_..'--(,_..'`-.;.'
> _______________________________________________
> hybi mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/hybi
>