Subject: Last Call: <draft-ietf-tram-alpn-06.txt> (Application Layer Protocol Negotiation (ALPN) labels for Session Traversal Utilities for NAT (STUN) Usages) to Proposed Standard

From: Adam Langley <[email-masked]>
Date: Wed, 8 Oct 2014 10:24:08 -0700

In the introduction of this document[1], the first example appears to
endorse the idea that a firewall would inspect a TLS handshake and
quash the communication if it saw an ALPN identifier that it didn't
like.

If I'm not misunderstanding this example, then it's contradictory to
the work that the TLS WG is chartered to do[2]:

"Develop a mode that encrypts as much of the handshake as is possible
to reduce the amount of observable data to both passive and active
attackers."

It would be disappointing if an RFC explicitly endorsed middleware
that tries to parse high-level protocols and interferes with the
network based on the result. There might not be much that we can do
about it, but we don't have to condone it.

Cheers

AGL

[1] https://tools.ietf.org/html/draft-ietf-tram-alpn-06#section-1
[2] https://datatracker.ietf.org/doc/charter-ietf-tls/

-- 
Adam Langley [email-masked] https://www.imperialviolet.org

---

From: Simon Perreault <[email-masked]>
Date: Thu, 9 Oct 2014 11:23:36 -0400

Adam,

Is your concern specific to TRAM's proposed use of ALPN, or does it apply
to ALPN in general?

Thanks,
Simon

---

From: Adam Langley <[email-masked]>
Date: Thu, 9 Oct 2014 08:41:16 -0700

On Thu, Oct 9, 2014 at 8:23 AM, Simon Perreault <[email-masked]> wrote:
> Is your concern specific to TRAM's proposed use of ALPN, or does it apply to
> ALPN in general?

In general I think the IETF should be promoting the end-to-end
principle. My concern is specifically about TRAM implicitly endorsing
the idea that the network should be applying policy like that.

(There's also a fair amount of irony in that fact that the second
example suggests ALPN be used to get around the fact that networks
often discriminate based on TCP port numbers, and the first example is
suggesting that networks do exactly the same thing to ALPN
identifiers.)

Cheers

AGL