Re: Getting our definitions of encryption straight for the HTTP/2 security discussion

My only comment is that current HTTP/1.1 supports opportunistic encryption via RFC 2817 (HTTP Upgrade to TLS).  Both the client and server can initiate an upgrade.


On Nov 20, 2013, at 4:24 PM, Paul Hoffman <paul.hoffman@gmail.com> wrote:

> Greetings again. Over the past weeks, people are sometimes talking past each other when they say they want to "always encrypt" HTTP/2 traffic. In specific, many people have used the term "opportunistic encryption" in very different ways without knowing it.
> 
> To help people at least understand what each other might be saying in the future, I created a page with some definitions that hopefully everyone can use. Comments are welcome.
> 
> http://trac.tools.ietf.org/wg/httpbis/trac/wiki/encryption-definitons
> 
> --Paul Hoffman

_______________________________________________________________
Michael Sweet, Senior Printing System Engineer, PWG Chair