Re: [quicwg/base-drafts] Stronger protocol negotiation requirement (#2284)

[janaiyengar <[e-mail]>]

janaiyengar commented on this pull request.



> @@ -1208,15 +1208,18 @@ protection for the QUIC negotiation.  This does not prevent version downgrade
 prior to the completion of the handshake, though it means that a downgrade
 causes a handshake failure.
 
-TLS uses Application Layer Protocol Negotiation (ALPN) {{!RFC7301}} to select an
-application protocol.  The application-layer protocol MAY restrict the QUIC
-versions that it can operate over.  Servers MUST select an application protocol
-compatible with the QUIC version that the client has selected.
-
-If the server cannot select a compatible combination of application protocol and
-QUIC version, it MUST abort the connection. A client MUST abort a connection if
-the server picks an incompatible combination of QUIC version and ALPN
-identifier.
+QUIC requires that the cryptographic handshake provide authenticated protocol
+negotiation.  TLS uses Application Layer Protocol Negotiation (ALPN)
+{{!RFC7301}} to select an application protocol.  Clients and servers MUST use
+ALPN to negotiate an application protocol, unless another mechanism is used for
+agreeing on an application protocol.

Suggested rephrase: "Unless another mechanism is used for agreeing on an application protocol, endpoints MUST use ALPN for this purpose."

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/2284#pullrequestreview-189245568