Re: [TLS] Forged RST (was: About encrypting SNI)

[Eric Rescorla <[e-mail]>]

On Sat, Apr 19, 2014 at 12:40 PM, Watson Ladd <[e-mail]> wrote:

> On Sat, Apr 19, 2014 at 12:20 PM, Eric Rescorla <[e-mail]> wrote:
> >
> >
> >
> > On Sat, Apr 19, 2014 at 8:55 AM, Bill Frantz <[e-mail]>
> wrote:
> >>
> >> On 4/17/14 at 1:27 AM, [e-mail] (Yoav Nir) wrote:
> >>
> >> > Those who won't use TCP are doomed to re-create it. To get a UDP-based
> >> > protocol to replace TCP for
> >> > the web you'd need all of reliable delivery through (selective?)
> >> > retransmissions, bandwidth
> >> > detection, replay protection, a whole lot of things that took the
> >> > transport community years to get
> >> > right. Yes, there have been many attempts, but there's a reason TCP is
> >> > still the protocol everyone
> >> > uses for pretty much any type of bulk transfer. And this is before we
> >> > even begin to talk about
> >> > middleboxes dropping unrecognized UDP services.
> >>
> >> Absolutely correct.
> >>
> >> However, one could set up a DTLS session and then initialize the TCP
> >> protocol within that session.
> >>
> >> I don't think anyone has considered this inversion before. It may not be
> >> useful, but..
> >
> >
> > This is how WebRTC DataChannels work, except that it's SCTP rather than
> TCP.
> >
> > http://tools.ietf.org/html/draft-ietf-tsvwg-sctp-dtls-encaps-03
> >
> > The WG did consider TCP but selected SCTP for a variety of reasons that
> > probably
> > don't bear going into here. You certainly could build the same thing with
> > TCP.
>
> This is also how MinimaLT, CurveCP, and indeed TCP over IPSec
> (assuming we fix the issues that stop IPSec at the application layer
> from working) work. The flow control issues are easy: copy the
> algorithm from TCP. The firewall issues are not.
>

Yes, the firewall issues are fairly complicated. The good news is that
they're quite a bit easier in client-server type applications because
servers generally have public IP addresses (otherwise you pretty
much cannot connect to them via TCP). Basically, either the client
is behind a network element (firewall/NAT) which lets UDP in and
out or it's not. If it is (estimates for this vary, but rumors are ~95%),
then client-server TCP over UDP variants should work.

The situation is of course much more complicated for P2P
applications, and in such applications you need ICE and generally
a media relay server.

-Ekr