IETF Logo Mail Archive

Re: [hybi] Why not just use ssh?

Adam Barth <ietf@adambarth.com> Wed, 01 September 2010 21:28 UTC

Return-Path: <ietf@adambarth.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 1E8A83A6841 for <hybi@core3.amsl.com>; Wed, 1 Sep 2010 14:28:35 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.097
X-Spam-Level:
X-Spam-Status: No, score=-2.097 tagged_above=-999 required=5 tests=[AWL=-0.120, BAYES_00=-2.599, FM_FORGED_GMAIL=0.622]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id kxGfWVp9Qaie for <hybi@core3.amsl.com>; Wed, 1 Sep 2010 14:28:34 -0700 (PDT)
Received: from mail-ey0-f172.google.com (mail-ey0-f172.google.com [209.85.215.172]) by core3.amsl.com (Postfix) with ESMTP id 1667E3A684B for <hybi@ietf.org>; Wed, 1 Sep 2010 14:28:33 -0700 (PDT)
Received: by eyd10 with SMTP id 10so5099705eyd.31 for <hybi@ietf.org>; Wed, 01 Sep 2010 14:29:03 -0700 (PDT)
Received: by 10.216.158.7 with SMTP id p7mr423772wek.58.1283376542274; Wed, 01 Sep 2010 14:29:02 -0700 (PDT)
Received: from mail-iw0-f172.google.com (mail-iw0-f172.google.com [209.85.214.172]) by mx.google.com with ESMTPS id p82sm6497395weq.27.2010.09.01.14.29.01 (version=SSLv3 cipher=RC4-MD5); Wed, 01 Sep 2010 14:29:01 -0700 (PDT)
Received: by iwn3 with SMTP id 3so7830931iwn.31 for <hybi@ietf.org>; Wed, 01 Sep 2010 14:29:00 -0700 (PDT)
Received: by 10.231.59.83 with SMTP id k19mr9630693ibh.178.1283376540213; Wed, 01 Sep 2010 14:29:00 -0700 (PDT)
MIME-Version: 1.0
Received: by 10.231.187.218 with HTTP; Wed, 1 Sep 2010 14:28:29 -0700 (PDT)
In-Reply-To: <20100901211959.GA10275@1wt.eu>
References: <d48398080b610405d982ffd924f58e27.squirrel@sm.webmail.pair.com> <AANLkTin8CiHFoOSFdcRPern5YY-FdODC4GST+BrP3t_j@mail.gmail.com> <AANLkTi=fn2JE7a0b_0KFFLwq3eG_-xnaRazXAMPGi0N3@mail.gmail.com> <CA566BAEAD6B3F4E8B5C5C4F61710C110FAFBCBD@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com> <AANLkTinE1MB10nUhpnU-SC+aLjPmFyu3NhjLC1-wMmW7@mail.gmail.com> <CA566BAEAD6B3F4E8B5C5C4F61710C110FAFBEF4@TK5EX14MBXW605.wingroup.windeploy.ntdev.microsoft.com> <AANLkTim5Wsfohbn2S0jpm6CDkq+xFcpzDTRWJ0YXWbcg@mail.gmail.com> <20100901211959.GA10275@1wt.eu>
From: Adam Barth <ietf@adambarth.com>
Date: Wed, 01 Sep 2010 14:28:29 -0700
Message-ID: <AANLkTik2ggyrTQG5hExX3f2K+Ly1R_A9yM6fZEUawsz-@mail.gmail.com>
To: Willy Tarreau <w@1wt.eu>
Content-Type: text/plain; charset="ISO-8859-1"
Cc: "hybi@ietf.org" <hybi@ietf.org>
Subject: Re: [hybi] Why not just use ssh?
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 01 Sep 2010 21:28:35 -0000

On Wed, Sep 1, 2010 at 2:19 PM, Willy Tarreau <w@1wt.eu> wrote:
> Also, I don't see why TLS could not be used on top of HTTP as is proposed
> by 2817. This has the advantage of HTTP being easy to handle with existing
> infrastructure and offers the better protection of TLS.

RFC 2817 is a joke and, as I understand things, about to be moved to
historic.  Adding an HTTP framing arounds TLS is a bad idea for two
reasons:

1) It adds an extra round-trip.
2) It defeats the TLS-based handshake's resistance to cross-protocol attacks.

Adam

v2.23.0 | Report a Bug | By Email