Re: [TLS] TLS 1.3 Application Identifier ?

[Alyssa Rowan <[e-mail]>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

On 16 July 2014 09:32:31 BST, Pascal Urien <[e-mail]> wrote:

>It seems there is no identifier for the application SDU transported by
>TLS
>1.3 (which is obviously a transport protocol)
>
>With the legacy TLS, the application is identified by a TCP or UDP
>port.
>Some TLS extensions have been proposed to solve this issue.

Perhaps I am misunderstanding: are you not describing ALPN? It seems what you want is an ALPN identifier for your protocol, am I correct?

ALPN seems to be proposed as the preferred way to do this for 1.3, is my understanding.

There are obvious metadata concerns involving an untrusted intermediary identifying and demultiplexing different applications transported over TLS (current ALPN is plaintext) and ways to address this are being explored by the WG (although this has tension with those who run large-scale traffic balancers which would prefer to avoid doing crypto for both scale and key security reasons; I'm not sure that can be cleanly resolved in a privacy-preserving manner which satisfies everyone).

- --
/akr
-----BEGIN PGP SIGNATURE-----
Version: APG v1.1.1

iQI3BAEBCgAhBQJTxkMVGhxBbHlzc2EgUm93YW4gPGFrckBha3IuaW8+AAoJEOyE
jtkWi2t6KOoP/jnvQ4WhOW1/1U1AeFn8p/y3qlaBEelH04jasu3PClTNk8c2ddGx
ICv6rE1rv8xIA6m1LrqG5kUVqctnUq2JuH6G6FRg2cu8N7QkImaIIZXZzgpmIXmW
wVTCQ+RN4kmpsYMwdd+ZcwHVORbu09lnG9MI+Bt3Ybv2ck1NLjVz5+o0Iai6HOwu
S0zMl8cjB2husFluuUUkt4Rk56l415hQf8VF4I4zHkIYcx5b5DHBrZRD+COCCuKO
kqzeDSl09HVAGYQfkf1WzubUpq501mi39uHvFAY/NYrY51/e6g0fDQavd795bxXT
rldVix9o8Y6CXSBkK/aKTMgvhoa5GCiBRE3zOAYuSZbpvTUbWwLFDHASkasnQCo1
yyDgGJXuY8P0dWMKQ0ufOmJ7AgLJnp8EaqjWY1BXAticEPPhQYAtY9oMriuyzd2p
rw7HkHmIwpCb0Cqu705jFSY+x0F3R+QvhDdGg2jHQIxCUF+2L81oD4n/ekqRZK/n
B1CkATZoxq4mLHS7rPDLU9HNqRHbhkkUSFmpiE+4KIIarNRfUp+tJzZtAvazo5hw
iDY+IvQ8mWpUCvvL95LwSSWE4D4PPDMCltcT/6HSBT1080BtaU+r+5HeSAaQRsSq
94EtgkuczqRbQjvvgc1nqe11ZK3MZx+RQI9+Qu3r1i3151yV/qPczonh
=x0a+
-----END PGP SIGNATURE-----