Subject: [TLS] New direction for TLS?

From: "Michael D'Errico" <[email-masked]>
Date: Fri, 14 Feb 2020 09:46:56 -0500

Hi,

It's been a long time since I posted to this list but saw that the charter is being updated and wanted to share an idea I had a while ago but have not found the time to work on.  The TL;DR is to deprecate TLS and rebuild security on top of DTLS. With DTLS, you have encrypted packets, so think of them as the new IP and build TCP on top of that.  It'd be like making the internet run on TCP/DTLS instead of TCP/IP, so most of the work is already done.  I think this is all I need to say to get the idea across, but I can add detail if needed.

Mike

---

From: Benjamin Kaduk <[email-masked]>
Date: Fri, 14 Feb 2020 12:03:07 -0800

Hi Mike,

> It's been a long time since I posted to this list but saw that the charter is being updated and wanted to share an idea I had a while ago but have not found the time to work on.  The TL;DR is to de…

This sounds really similar to QUIC
(https://datatracker.ietf.org/wg/quic/documents); perhaps you could take a look
and try to describe any differences between your idea and what's being done
there?

-Ben

---

From: Yoav Nir <[email-masked]>
Date: Fri, 14 Feb 2020 23:01:22 +0200

> On 14 Feb 2020, at 22:03, Benjamin Kaduk <[email-masked]> wrote:
> 
> Hi Mike,
> 

If it’s TCP (rather than HTTP) on top of the encryption layer, it sounds more like transport-mode IPsec. That gives you encrypted packets.

The difference is whether the authentication and encryption is part of the service provided by the OS (like IP) or part of the application.

Yoav

---

From: "Michael D'Errico" <[email-masked]>
Date: Sun, 16 Feb 2020 12:47:45 -0500

Hi,

It looks like QUIC is even better than what I proposed. Thank you for suggesting it.

Mike