Re: [TLS] NextProtoNeg concerns

[Yoav Nir <[e-mail]>]

On Nov 18, 2011, at 1:36 PM, Marsh Ray wrote:

> On 11/17/2011 11:17 PM, Yoav Nir wrote:
>> 
>> What I really don't like about this proposal, is this text in section
>> 3: The "extension_data" field in a "ServerHello" and the
>> "NextProtocol" message contain opaque bytes to be used by the
>> application layer to negotiate the application layer protocol.  The
>> format of this data is not specified in this draft.
>> 
>> If you are defining a new extension/handshake message to carry a new
>> kind of data (application type) there is no value to this without a
>> definition of the format, either in the same document or in a
>> companion document.
>> 
>> The examples in the slides show a very specific format:
>> "\x06spdy/2\x08http/1.1\x08http/1.0". I don't see why this would not
>> be specified in the document. Of course, you would need to set up a
>> registry for these strings. For example, I can see how Microsoft
>> would want to register SSTP, and other vendors would register their
>> own SSL-VPN protocols as well.
> 
> What if you're a small application developer, perhaps with a single 
> application or running only a few servers. Should you be expected to 
> register your format before using it?
> 
> Would it be expected to follow the same length-value format as the example?
> 
> Would anyone ever be denied registration? What if their format 
> definition was technically deficient, or they wanted to reserve a bunch 
> of unrelated protocol names?

That would be up to the draft to specify. You could do it as FCFS or technical expert review - no need for a draft.

And we could reserve some prefixes, like exp- (for experiment) and priv- (for private protocol). You could then safely use "exp-marshray-test1"