Re: [TLS] Working group last call for draft-ietf-tls-dtls-heartbeat-02

[Nikos Mavrogiannopoulos <[e-mail]>]

On 08/22/2011 07:07 AM, Joe Salowey wrote:
> This announcement is for the working group last call of 
> draft-ietf-tls-dtls-heartbeat-02.  Please send comments to the list 
> by September 09, 2011.

As I understand the draft this extension is 2 things:
1. A keepalive ping for TLS and DTLS
2. PMTU discovery mechanism for DTLS

My unanswered comments on a previous post [0] still stand.
I expand below.

I believe more rationale is needed in the draft on _why_ should
these issues be solved at TLS or DTLS level.
For (1), TCP has a keepalive mechanism, so reintroducing it at TLS
doesn't make much sense, and UDP throws the burden to user protocol. So
why not throw the burden on the protocol above?

The only discussion on text is:
  "Sending HeartbeatRequest messages allows the sender to make sure that
   it can reach the peer and the peer is alive.  Even in case of TLS/TCP
   this allows this check at a much higher rate than the TCP keepalive
   feature would allow."
So is this just a high-rate TCP keepalive? Why do we need that at the
security layer? Why not propose a high-rate TCP keepalive?


About (2) Both TCP and UDP don't bother with a special PMTU discovery
mechanism. Why should DTLS or TLS provide it? Are there advantages on
making a PMTU discovery at this level?


Note that I am not opposing to the idea of providing those, if there is
a good reason, but I don't see that now.

regards,
Nikos

[0]. http://www.ietf.org/mail-archive/web/tls/current/msg07580.html