Re: [hybi] On TLS-only Approaches

["Brian Smith" <[e-mail]>]

John Tamplin wrote:
> It looks to me, according to openssl ciphers, the only NULL cipher
> supported is AECDH-NULL-SHA which still does SHA1 for integrity
> protection, so I assume it would have the same overhead. 
> RFC4346 seems to indicate a TLS_NULL_WITH_NULL_NULL
> CipherSuite option which would have a 0-byte MAC, so presumably
> you would only pay the 5-byte record overhead and there would be
> no padding.  That is more reasonable, but still seems large
> considering we have been arguing over a few bytes in the framing.

I don't think it's realistic to expect people to have unencrypted TLS cipher
suites enabled. For one thing, people expect that "https" = "secure" =
"encrypted" at a minimum.

The AES-GCM modes are authenticated and encrypted and have 21 bytes of
overhead per record. I think that's the minimum size overhead that you are
going to get realistically. (I am 100% certain that there will be an AES-GCM
implementation contributed to NSS soon.)

Also, keep in mind that with TLS, you can use TLS compression, which allows
you to compress the headers as well as the data, and which allows you to
maintain compression state across requests and across responses.
Consequently, it would be surprising to me if WebSockets over TLS didn't
result in *smaller* messages when the TLS implementation supports
compression. Memory overhead for compression is a concern but there are
tricks to mitigate that.

Regards,
Brian