Re: [TLS] A new consensus call on ALPN vs NPN (was ALPN concerns)

[Nikos Mavrogiannopoulos <[e-mail]>]

On Thu, 2013-12-12 at 14:42 +0000, Yoav Nir wrote:

> I preferred ALPN for the following reasons:
>       * ALPN leaks very few bits of relevant information. For
>         starters, it's HTTP/1 vs HTTP/2, which is not interesting at
>         all, as they convey the same information. There are
>         suggestions to place more things there, like various mail
>         protocols. Whether that happens or not, knowing that someone
>         is reading mail rather than browsing the web is a small amount
>         of information. This should be balanced against:

I also prefer ALPN, for the additional reasons, that (1) uses the
standard TLS extension mechanism, and (2) a load balancer, or
super-server can distribute the protocols indicated in ALPN to various
(different) servers. That cannot be done in any efficient way using
NPN. 

While I believe privacy concerns are important, in that case nothing is
revealed to an adversary that was not available before (i.e., the
service was always known due to TCP port number). Moreover applications
that require privacy can always use steganography and advertise a phony
protocol.

TLS has specific design goals, and hiding the service and the connecting
peers were never among them (don't say I agree with that). Adding both
is a major redesign, which I agree with the calls to be postponed to TLS
1.3 (or 2.0). Otherwise if every extension designs its privacy goals
differently, we get a protocol full of hacks that doesn't allow to be
improved in a sensible way.

regards,
Nikos