- From: Ilari Liusvaara <ilari.liusvaara@elisanet.fi>
- Date: Thu, 5 Feb 2015 18:28:45 +0200
- To: Erik Nygren <erik@nygren.org>
- Cc: "ietf-http-wg@w3.org Group" <ietf-http-wg@w3.org>
On Thu, Feb 05, 2015 at 10:08:58AM -0500, Erik Nygren wrote:
>
> One proposal that came out of some offline discussion would be for clients
> capable of doing HTTP/2 OppSec to always send in the client_hello
> alpn=h2,h2o (where "h2o" here might be some alpn token for HTTP/2 OppSec
> for HTTP scheme).
> The server would then:
>
> * Negotiate alpn=h2o with a possibly invalid cert for an HTTP-only
> ServerName/Host
> * Negotiate alpn=h2 with a valid cert for a ServerName/Host supporting HTTPS
> * Return a TLS handshake error ("no cert for this hostname") if neither are
> available (eg, for HTTP/1.1)
>
> The downside of this is that the "h2o" server_hello negotiation would be
> in-the-clear in TLS 1.2 (not desirable), although it will be encrypted in
> TLS 1.3. In true "opportunistic" fashion this may be an acceptable
> trade-off as clients and servers supporting TLS 1.3 will then get the
> additional level of protection over passive eavesdroppers seeing whether
> OppSec was negotiated.
Even TLS 1.3 won't encrypt the ALPN (at least as TLS 1.3 currently is).
-Ilari
Received on Thursday, 5 February 2015 16:29:11 UTC