Re: Mandatory encryption *is* theater

On 8/25/13 10:05 PM, Mike Belshe wrote:
>
>
>
> On Sun, Aug 25, 2013 at 11:46 AM, Eliot Lear <lear@cisco.com 
> <mailto:lear@cisco.com>> wrote:
>
>     Will,
>
>
>     On 8/25/13 5:29 PM, William Chan (陈智昌) wrote:
>>
>>     Another key distinction is encryption does not require
>>     authentication, so a proper cert is not mandatory. I'm surprised
>>     you mention requiring a proper cert given that you clearly
>>     understand a proper cert isn't necessary, given your reply to
>>     Yoav below. I think it's worthwhile to discuss the asserted
>>     benefit, but any statement about the current proposal requiring
>>     proper certificates sounds factually incorrect as far as I can
>>     tell. Did I miss something here?
>>
>
>     Possibly you did or possibly I did.  I have two specific issues
>     with anonymous encryption:
>
>     1.  The threat it is addressing may be better dealt with at other
>     layers; and
>     2.  It is often sold as more than it is.
>
>     As I wrote, I do like the idea of DANE + DNSSEC and then expanding
>     on that.  Got code for that?  If it's real privacy (not just
>     encryption) then I'd probably be convinced (there is a matter of
>     responsibility, but I think  DANE + DNSSEC could get us there, as
>     can certs from credible CAs).
>
>     And just for the record:
>
>
>>     Yes, the proposal is that it is mandatory for the server to
>>     implement and offer encryption.
>
>     That is in fact my objection, particularly the "offer" part.  You
>     seem to be assuming (forgive me if you are not) that many
>     implementations small and large AND many deployments small and
>     large will do a whole lot of work for that offer where past
>     experience shows that they won't, but rather that it will in fact
>     hinder implementation and deployment of the rest of HTTP2. There
>     is an obvious question about the goals for HTTP2...
>
>
> I want to challenge your 'past experience' argument since you've said 
> it 2 or 3 times now...
>
> IPv6 suffered from slow deployment for reasons unrelated to security. 
>   a) It offered little value.  b) The main value it did offer was more 
> easily implemented through NAT c) it required OS-level upgrades to 
> install.
>
> HTTP/2 has none of these problems, while also having real monetary 
> benefit.  This is exactly the reason why SPDY has become the fastest 
> deployed protocol on the internet ever - from zero to a billion+ users 
> in about a year.
well it would be better to provide the figure of the percent of SPDY 
traffic rather then the number of users that have it available in the 
browser.
Do you have it?

> With HTTP/2 have the headroom to make TLS a requirement without 
> breaking deployment.

yes TLS has helped to make the deployment fast no matter, and that what 
you have to do when you are working on something new;
but when it comes to standardize something would be much better at least 
try to integrate it more smoothly and seamlessly
with the rest of the Internet architecture

>
> Finally, implementations don't have to do "a whole lot of work". 
>  Implementing and deploying TLS is trivial these days.
that is true, but this is not the point

/Salvatore
>
> Mike
>
>
>
>
>     Eliot
>
>


-- 
Salvatore Loreto, PhD
www.sloreto.com