Re: [TLS] Questions about ALPN

[Adam Langley <[e-mail]>]

On Wed, Apr 9, 2014 at 8:54 AM, Paul Kyzivat <[e-mail]> wrote:
> For instance, the draft doesn't mention DTLS. But I have found discussion
> elsewhere that says it is intended to be used for DTLS.

Yes, it applies to DTLS also, although I don't know anyone use it for such yet.

> OTOH, it is far from clear that the *same* registry should be used for both
> TLS and DTLS. The two transports have significantly different
> characteristics, so that many application protocols will only work over one
> or the other. (Or if they work over both, they might arguably be *different*
> protocol variants.)

I believe there is only one registry. I don't think that there's
danger of ambiguity here. If the connection is DTLS then it's
obviously the DTLS varient of the protocol that should be used.

> And what about using the ALPN registry for protocols that run on top of
> transports other that TLS and DTLS? Is that appropriate?

I don't think so.

> - Specify the policy IANA is to use for deciding whether to accept
>   a new registration in the ALPN registry. (You can't define a new
>   registry without this.)

The policy is Expert Review as given in the draft.

> - Specify clearly the information that is to appear in the ALPN
>   registry. IMO, in addition to the name this needs to include
>   *at least* the transport protocol(s) over which the application
>   layer protocol is valid.

I don't think this additional bureaucracy is useful. I can't imagine a
situation where this is going to help someone.

> - Specify the transport layer protocols that are valid transports
>   of ALPN protocols.

Mentioning DTLS is something that I think has general agreement for
inclusion in the next revision of the draft.

> - Specify the acceptable syntax of ALPN names

ALPN names are bytestrings, there's no syntax.

> - Specify guidelines for when it is appropriate to add a new protocol
>   to the ALPN registry. (E.g., when it is intended to be used in
>   NPN negotiation in TLS and DTLS.)

I would hope the expert in the Expert Review would notice a request
that was so confused that they were applying for an ALPN string when
not using (D)TLS!


Cheers

AGL