Re: [TLS] [Uta] Recommending ALPN (was Re: [dns-privacy] Martin Duke's No Objection on draft-ietf-dprive-xfr-over-tls-11 ...)

[Stephen Farrell <[e-mail]>]

Hiya,

I like the text below as a starter. I'd suggest it also
include something to take into account the ECH issue
mentioned on the dpriv list [1]

S

[1] 
https://mailarchive.ietf.org/arch/msg/dns-privacy/3xL59_1P0ZHOUEYsDJ1Q22ZZVvo/

On 30/04/2021 07:46, Martin Thomson wrote:
> On Fri, Apr 30, 2021, at 16:25, Valery Smyslov wrote:
>> The original motivation for 7525bis was to update RFC 7525 in light
>> of TLS 1.3 appearance. However, I believe that recommendations for
>> using ALPN are in scope of this document.
> 
> How about a new Section 3.7 "Application-Layer Protocol
> Negotiation":
> 
> --- TLS implementations MUST support the Application-Layer Protocol
> Negotiation (ALPN) extension [RFC7301].  Correct use of ALPN ensures
> that clients and servers agree on a negotiated protocol.
> 
> Newly defined application protocols that use TLS MUST define an ALPN
> identifier and mandate the use of ALPN for negotiating the protocol.
> 
> An existing application protocol might not have been assigned an ALPN
> identifier.  For other protocols the ALPN identifier might not have
> been part of the original protocol definition, or use of ALPN might
> have been defined originally as being optional.  In all of these
> cases, implementations cannot require the use of ALPN.  A server
> implementation MUST fail a connection attempt with a fatal
> "no_application_protocol" alert if it is configured to use a protocol
> that has no assigned ALPN identifier and a client offers an
> "application_layer_protocol_negotiation" extension. ---
> 
> This last bit might be an update to RFC 7301, but it's important for
> protecting against cross-protocol attacks on clients that support
> protocols with ALPN identifiers where the use of ALPN is not
> guaranteed.
> 
> _______________________________________________ Uta mailing list 
> [e-mail] https://www.ietf.org/mailman/listinfo/uta
>