Re: null ciphers in 9.2.2

On Sep 30, 2014, at 6:46 PM, Stephen Farrell <stephen.farrell@cs.tcd.ie> wrote:

> 
> 
> On 01/10/14 00:36, Greg Wilkins wrote:
>> 9.2.2 attempts to avoid surprises by suppressing innovation.  It fails to
>> recognise that some surprises are pleasant surprises.
>> 
>> Let's not limit the usage of this protocol by the limit of our imaginations.
> 
> Sorry to rain on the rhetorical games, but no, 9.2.2 (perhaps
> a little clumsily) just seems to me to try reflect where TLS1.3
> is heading towards.

Except that TLS 1.3 is designed to be backwards compatible with TLS 1.2, including the ability to use less modern ciphers, which will most definitely be used with H1 clients. HTTP/2 is adding restrictions above and beyond what TLS 1.3 requires, and placing addition restrictions on TLS 1.2.

If HTTP/2 simply wanted to reflect where TLS 1.3 was heading towards, it could accomplish that by requiring the capabilities of 1.3, and leaving out the social hack.

--
Jason T. Greene
WildFly Lead / JBoss EAP Platform Architect
JBoss, a division of Red Hat

Received on Wednesday, 1 October 2014 03:06:09 UTC