Subject: [TLS] Alternative to ALPN and NPN

From: Nico Williams <[email-masked]>
Date: Thu, 14 Mar 2013 14:20:20 -0500

My proposal:

 - ClientHello and ServerHello to include an extension whose presence
indicates two things:

   a) the record type for all records post-handshake will be
application (except for alerts about decryption failures);
   b) the plaintext (i.e., after decryption) payload of the record
will have an actual record type prepended;
   c) the client MAY send a first post-handshake record that is a new
handshake record type whose purpose is to specify which application
protocol the client wishes to use (this record will externally appear
to be application data, per-(a));
   d) if the server doesn't like the client's choice of application
protocol it will reply with a new handshake record type (externally
this will appear to be an application record, see (a)) indicating what
protocols it supports and it will discard any application data from
the client until the next application protocol start record from the
client (as in (c).

Benefits:

 - eavesdroppers and non-MITM middleboxes get no information about the
application protocol (except for record length matters)
 - in optimistic case no extra round trips are incured

Regarding traffic analysis issues (initial record lengths):

 - we could have a bit in the byte prepended to the plaintext to
indicate that it is really a sequence of type-length-value, so we can
bundle some actual app data into the first record

 - we could have a bit in that same byte to indicate padding with
random to-be-ignored data

 - and the sender can fragment the initial record as needed, of course

which altogether would allow clients to ensure that first app record
lengths match whatever a middlebox might expect.

Nico
--

---

From: Yoav Nir <[email-masked]>
Date: Thu, 14 Mar 2013 20:02:39 +0000

Drawback: this increases the size of each record (because the type is not prepended to the actual value).

On Mar 14, 2013, at 3:20 PM, Nico Williams <[email-masked]> wrote:

> _______________________________________________
> TLS mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/tls
> 
> Email secured by Check Point

---

From: Nico Williams <[email-masked]>
Date: Thu, 14 Mar 2013 15:11:14 -0500

> Drawback: this increases the size of each record (because the type is not prepended to the actual value).

By one byte, yes.  (And perhaps we'll want more, for alignment.  That
should be an option though, not a requirement.)

Also, we could have a message that says: no records other than
application or alert will be send from here on.  In that case we could
stop prepending the record type to the protected plaintext and send
any alerts' record type in the clear.

Nico
--