Re: [hybi] On TLS-only Approaches

[Adam Barth <[e-mail]>]

On Sun, Aug 22, 2010 at 12:49 PM, Roberto Peon <[e-mail]> wrote:
> There are downsides from the pure TLS approach, which we've not yet figured
> out how to overcome on the SPDY side.
> It boils down to ensuring that schools and other institutions can *easily*
> perform MITM monitoring/censoring.

Hum...  I'm not sure we should kowtow to proponents of censorship.

> We may already be facing these problems as we deploy a new protocol which
> their proxies don't understand.
> If we allowed/configured the NULL cipher for TLS, then MITM proxies could
> still monitor, if perhaps not censor, but you're asking for trouble there.

See below.

On Sun, Aug 22, 2010 at 1:10 PM, John Tamplin <[e-mail]> wrote:
> We have people complaining about the complexity of doing an extra comparison
> to interpret the length of a frame -- it seems to me that requiring a TLS
> implementation is unacceptable.  Think about all the small embedded devices
> which run a web server on very underpowered machines -- should they all be
> required to implement TLS?

At the least, we'll probably want to offer a version that doesn't
check the server's certificate so folks can use the protocol without
paying for a CA-validated certificate.  If embedded performance today
is important, we can certainly consider offering a simple ciphersuite
with this version (e.g., RC4).

Adam