Re: [TLS] Passive TLS Clients - Reverse Connections

[Mohamad Badra <[e-mail]>]

On Sun, Dec 15, 2013 at 4:47 AM, Watson Ladd <[e-mail]> wrote:

> On Sat, Dec 14, 2013 at 4:41 PM, Mohamad Badra <[e-mail]> wrote:
> > Dear All,
> >
> > I've submitted the following document to enable a TLS connection from a
> > server to a client after the initial handshake is complete.
> Do you have a use case for this? Because once the handshake finishes
> you have a perfectly good connection.
> If an application protocol requires this, it can do it at the application
> level.
> Sincerely,
> Watson Ladd
>

​​I don't have an exhaustive list of scenarios where this extension could
be useful:

​- Some of the applicative resources may be hosted behind a proxy or a
firewall that implements NAT for the internal network IP addresses. They
may be hosted on devices in stealth mode or with dynamic IP addresses so
mapping between the resources and IP is not efficient.

- It is suitable for network management protocols such as NETCONF(*). It
will be easier to extend TLS than revising every application to enable
reverse connection over TLS And assign a new port number.

- In the case of reverse connections, it would be more secure to
configure your server (it may be easier to secure one open port than to
having an open port on each server in the network).

(*) Other benefits related to device management may be found at
http://tools.ietf.org/html/draft-ietf-netconf-reverse-ssh-02#section-3.

Best regards,
Badra