Re: [tcpm] SYN/ACK Payloads, draft 01

On Thu, Aug 14, 2008 at 2:25 PM, Joe Touch <touch@isi.edu> wrote:
> So let's consider secure HTTP. That could have been done with a TCP
> option, but instead it was done in exactly the way you don't think works
> - - a new port, and a new URI prefix (https:). Initially, users needed to
> know what to type; eventually, that ended up being embedded in URLs on
> web pages people click anyway (e.g., search engine results).

HTTPS was slightly different because it had to be resistant to
downgrade attacks - it couldn't have been done as an option for that
reason.

However, I'd cite HTTPS as an example that new uri schemes don't work.
Despite widespread support, far too few people use it. There are other
user interaction problems with TLS (and all other secure protocols) to
be sure (user's will click past invalid certificate warnings etc), but
having to know what "https" is certainly one of them. (One's mother is
the canonical example here, but you can confirm this by asking random,
non-technical people)

> What you're *really* asking for is a way to send data from client to
> server BEFORE the TWHS completes. You talk about server-talks-first, but
> it's really the client speaking - by sending the option.

Hmm, yea. That's a fair view of matters. I'm sending a single bit from
the client in the SYN.

> I don't support the idea that doing this in TCP is appropriate just to
> get around deployment issues.

Ok. You've certainly understood the issues, so that's reasonable. If
others feel the same way I shall withdrawl the options request and
figure out another path.

Thanks for all your time, Joe.

AGL

-- 
Adam Langley agl@imperialviolet.org http://www.imperialviolet.org
_______________________________________________
tcpm mailing list
tcpm@ietf.org
https://www.ietf.org/mailman/listinfo/tcpm