Re: [TLS] Forged RST (was: About encrypting SNI)

[Yoav Nir <[e-mail]>]

On Apr 19, 2014, at 6:55 PM, Bill Frantz <[e-mail]> wrote:

> On 4/17/14 at 1:27 AM, [e-mail] (Yoav Nir) wrote:
> 
>> Those who won’t use TCP are doomed to re-create it. To get a UDP-based protocol to replace TCP for 
>> the web you’d need all of reliable delivery through (selective?) retransmissions, bandwidth 
>> detection, replay protection, a whole lot of things that took the transport community years to get 
>> right. Yes, there have been many attempts, but there’s a reason TCP is still the protocol everyone 
>> uses for pretty much any type of bulk transfer. And this is before we even begin to talk about 
>> middleboxes dropping unrecognized UDP services.
> 
> Absolutely correct.
> 
> However, one could set up a DTLS session and then initialize the TCP protocol within that session.

You mean a security layer between the IP layer and the transport layer? 

> I don't think anyone has considered this inversion before. It may not be useful, but…

Except people who have implemented IPsec in transport mode. For compatibility with NAT, it can use UDP with port 4500.

Really, the only advantage of DTLS over IPsec is that the TLS handshake is easier to deploy than IPsec’s key exchange (IKE), because IKE demands mutual authentication, and deploying client credentials is so hard, some people would like us to remove it entirely from TLS 1.3.

What would work nicely (and some vendors have products that do this already) is initiating IPsec in a client/server model, where the client receives the details of the IPsec SA from the server. That transaction could run over UDP or even over HTTPS.  Of course, I think this is the wrong mailing list to discuss a suggestion like this.

Yoav