Re: [TLS] Questions about ALPN

[Daniel Kahn Gillmor <[e-mail]>]

On 04/09/2014 02:03 PM, Martin Thomson wrote:
> On 9 April 2014 10:29, Andrei Popov <[e-mail]> wrote:
>> ALPN registry is defined under the "Transport Layer Security (TLS)" heading
> 
> Maybe we should instead consider whether that is an appropriate
> location for the registry.

whether we place the alpn registry under (D)TLS or not, including all
the httpbis labels becomes slightly weird.

if ALPN is *not* just for (D)TLS, then h2 is weird because it seems to
specify not only the inner protocol in question but also the outer
protocol -- what would h2 mean if it was specified in, say, an novel SSH
ALPN-identified channel?  would it be SSH-wrapping-TLS-wrapping-HTTP?
or just SSH-wrapping-HTTP?

if ALPN is just for (D)TLS, then h2c is weird because it is defined to
not be usable in (D)TLS either.

out of curiosity, how is h2c expected to interact with tcpcrypt, (if
that ever gets off the ground) or with IPSEC?  By definition, it's http
over "cleartext TCP".  But TCP over IPSEC is encrypted, as would be
TCPCrypt.  The obvious answer (which is "yeah yeah, it's still h2c,
ignore that your TCP channel itself is encrypted") doesn't line up with
the explicit wording of the draft ("cleartext TCP").  maybe it should
say something like "HTTP directly inside TCP" to head off this
hairsplitting.

regards,

	--dkg