Subject: [TLS] Update on False Start

From: Paul Hoffman <[email-masked]>
Date: Sat, 14 Apr 2012 10:43:46 -0700

<http://www.imperialviolet.org/2012/04/11/falsestart.html>

Not a good sign for TLS changes that require field updates...

--Paul Hoffman

---

From: Nikos Mavrogiannopoulos <[email-masked]>
Date: Sun, 15 Apr 2012 11:51:42 +0200

> Not a good sign for TLS changes that require field updates...

I don't know. There might have been other reasons to drop false start.
One that I can think of is that the benefits didn't outweigh the costs.
The cost is a lower security bar and incompatibility problems.
The benefit is improved user experience in a browser. Was such benefit
significant with false start? Did pages load faster? I'd expect to have
the majority of connections in a browser as resuming sessions, hence
improved loading time might not have been the case. Performance
improvement figures are missing for such an important extension.

regards,
Nikos

---

From: Yoav Nir <[email-masked]>
Date: Sun, 15 Apr 2012 13:38:45 +0300

> The cost is a lower security bar and incompatibility problems.

They had an explanation in their technical note, about why the security bar is not lowered. Whether or not we believe that the security argument is valid, they believed it. The incompatibility problems were unexpected. I think one of the big reasons that the Internet has moved to "everything over HTTP(S)" was to escape the middleboxes, because everything that goes over ports 80 or 443, and looks somewhat like HTTP or TLS gets through. 

The middleboxes just became "next generation middleboxes" and now the firewalls are deep inspecting the TLS connection, and the load balancers try to improve scale. You can no longer assume that all clients are IE, all servers are either IIS or Apache with OpenSSL, and the few outliers will have to adapt. Now there are dozens of implementations our there.

> improvement figures are missing for such an important extension.

I agree, but note that this was not an extension. It wasn't negotiated. Now that it's tied to NPN it will be negotiated. A naive implementation of TLS would work fine. I guess some of the middleboxes had no-so-naive implementations.

Yoav