Subject: [Tcpcrypt] Nuke TLS from orbit

From: Tony Arcieri <[email-masked]>
Date: Mon, 14 Apr 2014 14:22:02 -0700

Mentions Tcpcrypt:

http://clearcryptocode.org/tls/

-- 
Tony Arcieri

---

From: Nico Williams <[email-masked]>
Date: Mon, 14 Apr 2014 16:29:35 -0500

If we're to nuke TLS and... replace it with what?

My preferred answer would be IPsec+DANE, which would work as follows
on the client side:

1) apps get target's TLSA RRset (using the target's _host_ name FQDN, of course)
2) apps pass in this data to the socket as a socket option (or an
enhanced sockaddr)
3) apps connect() (even for UDP, of course)

4) the system guarantees that for the life of the connected socket its
packet flow will be protected by SAs whose peer's public credentials
match the given TLSA RRset.

The guarantee in (4) is very similar to the guarantee provided for in RFC5660.

Nico
--