Re: [TLS] NextProtoNeg concerns

[Marsh Ray <[e-mail]>]

On 11/17/2011 11:17 PM, Yoav Nir wrote:
>
> What I really don't like about this proposal, is this text in section
> 3: The "extension_data" field in a "ServerHello" and the
> "NextProtocol" message contain opaque bytes to be used by the
> application layer to negotiate the application layer protocol.  The
> format of this data is not specified in this draft.
>
> If you are defining a new extension/handshake message to carry a new
> kind of data (application type) there is no value to this without a
> definition of the format, either in the same document or in a
> companion document.
>
> The examples in the slides show a very specific format:
> "\x06spdy/2\x08http/1.1\x08http/1.0". I don't see why this would not
> be specified in the document. Of course, you would need to set up a
> registry for these strings. For example, I can see how Microsoft
> would want to register SSTP, and other vendors would register their
> own SSL-VPN protocols as well.

What if you're a small application developer, perhaps with a single 
application or running only a few servers. Should you be expected to 
register your format before using it?

Would it be expected to follow the same length-value format as the example?

Would anyone ever be denied registration? What if their format 
definition was technically deficient, or they wanted to reserve a bunch 
of unrelated protocol names?

- Marsh