Re: [TLS] How ALPN makes the http2-tls-relaxed option less secure, compared to NPN (was Re: ALPN concerns)

[Stephen Farrell <[e-mail]>]

On 12/09/2013 04:59 PM, Watson Ladd wrote:
> Why exactly does the client need to tell the server if it will
> validate the cert or not?
> Either the server has a cert that will validate, in which case it can
> use it always, or not, in which case
> there isn't a choice. Why signal to the world "I CAN BE FOOLED"?

I'm not sure there's that much point in getting into
the specifics of Mark's scheme, since the httpbis wg
haven't decided to go down that road yet. (They might
but then they might do something else, who knows.)

For me (wearing no hats) it seems like standardising
NPN might take away energy from tls1.3 and/or slow
its deployment, which'd be a concern.

I'd also think that in the real case of ALPN and
HTTP/2.0 it'll be entirely obvious which protocol is
being negotiated just from the sizes of the packets
for any tls version <= 1.2 so any privacy loss or
gain is extremely minor to non-existent for now.
(That's because of HTTP/2.0 being binary etc.)

And I'd hope tls1.3 will be where we'd get significant
privacy gains in a more well thought out manner, e.g.
perhaps addressing the kind of application traffic
padding that Alfredo's draft described as a built-in
feature. (Or some equivalent.)

I've not thought through the negotiation thing though,
i.e. as to the impact of clients still having to be
able to do tls1.2 & ALPN for HTTP/2.0 even after tls1.3
is available on both ends. That does sound like its
worth thinking through but I'd hope could be handled
well in tls1.3 while still getting the privacy
benefits.

S.