Re: [TLS] Heartbeat and padding

[Viktor Dukhovni <[e-mail]>]

On Mon, Apr 28, 2014 at 04:10:09PM -0700, Bill Frantz wrote:

> IMNSHO, the details of the heartbeat function should be specified very close
> to the application user. Only at that level can rational decisions be made
> about how often to heartbeat and with what timeout.
> 
> My vote goes to eliminating it from TLS.

Some applications don't have NOP messages.  If one wants to detect
remote disconnect without sending an application level message, or
to keep connection state alive across a stateful firewall, a
heartbeat can be useful, even over TCP.

However, a heartbeat over TCP does not require any payload or
response.  It can be a record-layer message with a zero-length
payload that elicits no response at all.  This gets no cryptographic
protection, but that just makes it cheaper and safer.

Of course such a NULL heartbeat would be very different from the
DTLS case and would have to be specified separately for TLS.

-- 
	Viktor.