Re: [TLS] Security concerns around co-locating TLS and non-secure on same port (WGLC: draft-ietf-tsvwg-iana-ports-08)

[Nicolas Williams <[e-mail]>]

On Tue, Nov 09, 2010 at 09:02:29AM -0800, Michael D'Errico wrote:
> t.petch wrote:
> >...
> 
> Since you put a smiley at the end, it seems you're kidding, but just to be
> clear....
> 
>   - the most important requirement for protocols is integrity; I don't
>     know how to achieve that without TLS.

There's the GSS-API...  There's IPsec...  The whole world isn't TLS...
though I think most apps from here on out will trend to using TLS.

(There's also SASL, though the SASL community has decided that new
mechanisms shouldn't have security layers, instead relying on channel
binding to TLS, so SASL doesn't really count :)

>   - personally I also want privacy; not because I'm doing anything wrong,
>     but because it's-none-of-your-business what I buy online and what I
>     discuss with people through email, etc.  I don't know how to achieve
>     this without encryption, thus TLS is an important tool.

And also because most web stuff uses cookies to track sessions (the web
app has no visibility into TLS sessions, so it needs its own method for
tracking what connections make up a session), and doesn't use TLS to
authenticate users.  Those cookies need confidentiality protection, even
if you thought that what you do on the web doesn't.

>   - what do you mean by expensive?  Google has published research results
>     showing that enabling TLS on their services required no more/different
>     hardware than they were using prior to switching on TLS.

Mostly this is a perception issue.  But also it helps to have decent TLS
and HTTP/1.1 implementations, so you can get session resumption, and
pipeline HTTP to amortize the cost of TLS session setup.  Also, not
everyone is Google; I'm not at all surprised that TLS didn't cost them
much, but I'd also not be surprised if TLS-all-the-time cost
significantly more than $0 for most online services not run by Google.

Nico
--