Re: [TLS] Impact of draft-ietf-mptcp-api on TLS

[Geoffrey Keating <[e-mail]>]

Florian Weimer <[e-mail]> writes:

> On 11/28/2012 08:52 PM, Geoffrey Keating wrote:
> 
> > Maybe a related example will help: suppose the user is trying to
> > connect to https://198.51.100.3.  There is an HTTP proxy configured,
> > so what the browser actually does is make a TCP connection to
> > 192.0.2.99, send 'CONNECT https://198.51.100.3', and then start the
> > SSL negotiation.  The certificate still has to mention 198.51.100.3,
> > and doesn't have to mention 192.0.2.99.
> >
> > So, in MPTCP, if the user asks for mphttps://198.51.100.3 (or
> > whatever), then 198.51.100.3 is the address that has to appear in the
> > certificate, even if the connection is redirected to some other
> > endpoint, even if the redirection happens before any data is actually
> > sent on the connection.
> 
> I suspect the confusion arises because if the interaction with
> 198.51.100.3 causes another connection with a different IP address to
> be created, it hast to be verified against the IP address 198.51.100.3
> as well.

Do you mean what MPTCP calls a "subflow", not "connection", here?  For
example, if a web page at 198.51.100.3 contains an image tag which
causes a new MPTCP connection to be created, that isn't verified
against 198.51.100.3, it's verified against where the image's URL says
the image should be.

If you do mean 'subflow', the key thing about that is that there is no
'verification' to do.  The certificate won't be sent again, there
won't be a new TLS negotiation.

> This is different from HTML over HTTPS, where additional connections
> use the embedded addresses and names for endpoint verification.  This
> is possible because in the HTML/HTTPS case, these names and addresses
> are protected by the TLS channel, while in MPTCP, they are not.

One way to look at this is that it's an OSI layering issue.  TCP and
MPTCP are layers 4 and 5.  TLS certificate validation occurs at layer
7, the application layer, the same layer as the fetching of HTML
images or the execution of JavaScript; TLS, HTTP, and the syntax of
HTML are layer 6.