Re: A non-TLS standard is needed

[Matt Joras <[e-mail]>]

On Mon, Apr 27, 2020 at 3:47 PM Paul Vixie <[e-mail]> wrote:

> On Monday, 27 April 2020 11:56:20 UTC Lars Eggert wrote:
> > Hi Paul,
> >
> > this is definitely a broader discussion - it's popping up in other
> places as
> > well.
> >
> > The IETF can certainly have this discussion somewhere, but the QUIC list
> is
> > probably not the right home for it, esp. not as we've entered the home
> > stretch with regards to closing the final open issues that will let us
> WGLC
> > the current specs.
>
> lars, et al, thank you for such recognition. if mirjam's draft isn't a WG
> item, i hope that those in charge will find a place for it. i do not
> expect to
> relitigate the mandate for TLS, but i do hope we can recommend some signal
> beyond destination UDP port number, which is arbitrary given ALT-SVC and
> the
> HTTPSSVC mechanisms, as the way a hardened private network can recognize
> some
> UDP flows as likely to be HTTP-related and thus permitted to form outbound
> flows. without this the applicability of QUIC will be less than it could
> be.
>
> in other words i am requesting advice, a redirect, beyond the source
> quench.
>
> I'm not saying I like the practice, but it is already somewhat common
place to make such decisions based on the ALPN. E.g. you could allow it if
the ALPN is "h3-whatever". This is still possible with QUIC as the ALPN is
encrypted but not private.

Matt Joras