[Uta] Opportunistic encryption and authentication agility

[Trevor Perrin <[e-mail]>]

A point I haven't seen in the recent debate:

Whether a TLS connection is "opportunistic" or "authenticated" depends
not just on the wire protocol but on the client's capabilities.

A client who possesses an HPKP or TACK pin, or is capable of querying
DANE or Convergence, might be able to authenticate a connection which
to a different client would be opportunistic.

So when we talk about OE at the protocol level, I think we're really
talking about whether to allow agility of authentication methods, or
mandate a specific method.

In the case of HTTPS, the Web PKI has been mandated.  A small site
that doesn't want to pay the costs of Web PKI but would be willing to
deploy cheaper methods (pinning; DNSSEC/DANE) cannot do so.

If opportunistic TLS was allowed, then we would have the ability to
deploy new auth methods without having to forever support whatever was
in vogue when the initial standard came out.

I think that argues in favor of opportunistic TLS, for HTTP and other protocols.


Trevor