Subject: [Unbearable] forward proxies.

From: John Bradley <[email-masked]>
Date: Fri, 10 Feb 2017 20:36:40 -0300

On a related proxy question.

If a user agent connects to a forward proxy, all the connections may be multiplexed over a single TLS connection.

If the proxy negotiates token binding, should the user agent still use different keys for each etld+1 or one for the proxy because there is only one TLS connection or just refuse to negotiate token binding.

The correct thing to do may depend on the sort of forward proxy it is(Transparent SOCKS etc).

We can leave it but someone may ask and having browsers be consistent probably a good thing,

John B.

---

From: Dirk Balfanz <[email-masked]>
Date: Sat, 11 Feb 2017 18:56:08 +0000

That's the kind of scenario that makes TokenBinding better than ChannelID.
The browser can use different keys on different HTTP requests, including
here, where it would be using different keys for different destination
servers.

Now, a forward proxy may not have the necessary relationships with the
downstream servers to communicate the Token Binding IDs securely, so
chances are that all the Token Binding is for naught in this case. But
you'll never know.

Dirk.

On Fri, Feb 10, 2017 at 3:36 PM John Bradley <[email-masked]> wrote:

If a user agent connects to a forward proxy, all the connections may be
multiplexed over a single TLS connection.

If the proxy negotiates token binding, should the user agent still use
different keys for each etld+1 or one for the proxy because there is only
one TLS connection or just refuse to negotiate token binding.

The correct thing to do may depend on the sort of forward proxy it
is(Transparent SOCKS etc).

We can leave it but someone may ask and having browsers be consistent
probably a good thing,

John B.

_______________________________________________
Unbearable mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/unbearable