Re: Stricter TLS Usage in HTTP/2

On Wed, Jun 4, 2014 at 11:42 AM, Richard Wheeldon (rwheeldo) <
rwheeldo@cisco.com> wrote:

> From: patrick.ducksong@gmail.com [mailto:patrick.ducksong@gmail.com] On
> Behalf Of Patrick McManus
>  > making the chosen ciphersuite depend on the version of HTTP selected is
> already a requirement of HTTP2. The proposal here is about a change to that
> criteria. Section 9.2
>
> Do we want to revisit that?


perhaps to make it stronger :)


> Personally, I feel that mandating stronger cipher suites makes a lot of
> sense but there're a couple of caveats:
> - I'm not sure how this plays with opportunistic TLS
>

we've implemented both the alt-svc and encryption drafts and enforce the
requirements of 9.2 and have not found this to be a problem.