Subject: [Unbearable] Multiplexed connections

From: Bill Cox <[email-masked]>
Date: Wed, 23 Mar 2016 19:17:22 -0700

Both SPDY and QUIC protocols used by Google multiplex multiple HTTP streams
over one connection to reduce handshake latency.  QUIC is really awesome at
this, and will significantly improve speed generally, I think.

What happens when a user talks to 2 or more eTLD+1 sites over a multiplexed
connection?  There is only one chance to negotiate TB key parameters, and
it is possible that the key types for requests multiplexed over the same
connection will be different.

Even scarier, although I think we simply have to agree this is beyond what
we can deal with: are there proxies out there that send multiple user
streams multiplexed over one connection to popular sites?

Bill

---

From: Dirk Balfanz <[email-masked]>
Date: Thu, 24 Mar 2016 16:58:04 +0000

My thoughts on this: The scenario you're describing implies that the two
domains sit behind a single TLS terminator, right? In that case it seems to
me it's ok to delegate negotiation of TB key parameters to that TLS
terminator, and in particular assume that the parameters will be identical.
If one domain or the other doesn't like the TB parameters that the TLS
terminator negotiates, it should probably go looking for a new hosting
provider. :-)

Of course, the actual keys used by the clients will be different, so
although the domains share a TLS terminator, they won't share user
identifiers.

Dirk.

On Wed, Mar 23, 2016 at 7:17 PM Bill Cox <[email-masked]> wrote:

> Both SPDY and QUIC protocols used by Google multiplex multiple HTTP
> streams over one connection to reduce handshake latency.  QUIC is really
> awesome at this, and will significantly improve speed generally, I think.
>
> What happens when a user talks to 2 or more eTLD+1 sites over a
> multiplexed connection?  There is only one chance to negotiate TB key
> parameters, and it is possible that the key types for requests multiplexed
> over the same connection will be different.
>
> _______________________________________________
> Unbearable mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/unbearable
>

---

From: Nick Harper <[email-masked]>
Date: Thu, 24 Mar 2016 10:20:53 -0700

> streams multiplexed over one connection to popular sites?

Chrome's spdy proxy code (https://www.chromium.org/spdy/spdy-proxy)
provides support for just that. The browser makes one ssl connection to the
proxy, but then tunnels multiple ssl connections to the sites it wishes to
connect to through the connection to the proxy. So there shouldn't be any
Token Binding concerns because the client will negotiate TB separately for
each site it connects to on the tunneled ssl connection for that site.