Subject: [hrpc] [[email-masked]: RFC 8164 on Opportunistic Security for HTTP/2]

From: Stephane Bortzmeyer <[email-masked]>
Date: Tue, 16 May 2017 16:10:03 +0200

This was a very hot discussion at the IETF 2-3 years ago during the
development of HTTP/2: should we have mandatory encryption,
opportunistic (best effort) encryption or what? At this time,
opportunistic encryption was postponed and the RFC is now published.

Subject: RFC 8164 on Opportunistic Security for HTTP/2
From: [email-masked]
To: [email-masked], [email-masked]
Cc: [email-masked], [email-masked], [email-masked]
Date: Wed, 10 May 2017 20:58:41 -0700 (PDT)
List-Id: "IETF announcement list. No discussions." <ietf-announce.ietf.org>

A new Request for Comments is now available in online RFC libraries.

        RFC 8164

        Title:      Opportunistic Security for HTTP/2 
        Author:     M. Nottingham, 
                    M. Thomson
        Status:     Experimental
        Stream:     IETF
        Date:       May 2017
        Mailbox:    [email-masked], 
                    [email-masked]
        Pages:      10
        Characters: 19620
        Updates/Obsoletes/SeeAlso:   None

        I-D Tag:    draft-ietf-httpbis-http2-encryption-11.txt

        URL:        https://www.rfc-editor.org/info/rfc8164

        DOI:        10.17487/RFC8164

This document describes how "http" URIs can be accessed using
Transport Layer Security (TLS) and HTTP/2 to mitigate pervasive
monitoring attacks.  This mechanism not a replacement for "https"
URIs; it is vulnerable to active attacks.

This document is a product of the Hypertext Transfer Protocol Bis Working Group of the IETF.

EXPERIMENTAL: This memo defines an Experimental Protocol for the
Internet community.  It does not specify an Internet standard of any
kind. Discussion and suggestions for improvement are requested.
Distribution of this memo is unlimited.

This announcement is sent to the IETF-Announce and rfc-dist lists.
To subscribe or unsubscribe, see
  https://www.ietf.org/mailman/listinfo/ietf-announce
  https://mailman.rfc-editor.org/mailman/listinfo/rfc-dist

For searching the RFC series, see https://www.rfc-editor.org/search
For downloading RFCs, see https://www.rfc-editor.org/retrieve/bulk

Requests for special distribution should be addressed to either the
author of the RFC in question, or to [email-masked].  Unless
specifically noted otherwise on the RFC itself, all RFCs are for
unlimited distribution.

The RFC Editor Team
Association Management Solutions, LLC

---

From: Niels ten Oever <[email-masked]>
Date: Tue, 16 May 2017 16:37:01 +0200

Hi Stephane,

Do you have more background on why it was postponed then, and OK to pass
now?

Cheers,

Niels

Niels ten Oever
Head of Digital

Article 19
www.article19.org

PGP fingerprint    2458 0B70 5C4A FD8A 9488
                   643A 0ED8 3F3A 468A C8B3

On 05/16/2017 04:10 PM, Stephane Bortzmeyer wrote:
> _______________________________________________
> hrpc mailing list
> [email-masked]
> https://www.irtf.org/mailman/listinfo/hrpc
>

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Sun, 21 May 2017 10:48:39 +0200

On Tue, May 16, 2017 at 04:37:01PM +0200,
 Niels ten Oever <[email-masked]> wrote 
 a message of 94 lines which said:

> Do you have more background on why it was postponed then, and OK to
> pass now?

The usual discussion: if you try to "upgrade" to HTTPS, even without
authentication, wouldn't it be detrimental for the effort to push for
more "real" HTTPS? Also, there was the idea to have HTTP/2 out
rapidly, not letting this discussion slow down the new version.

It is a RFC now, but with status Experimental, only. And with
mandatory authentication.