Subject: Re: [Ice] TLS Candidates

From: Bernard Aboba <[email-masked]>
Date: Fri, 17 Feb 2017 13:46:28 -0800

Roman said:

"We have encountered a few large corporate installations that only allowed
TLS connections to port 443."

[BA] We have also encountered these deployments, and initially
implemented a "fake" TLS handshake along the lines that Peter
describes. However, we found that some customers had installed deep
packet inspection boxes that could tell the difference between a
"fake" TLS handshake and a real one. So having a standardized way to
do TLS candidates would be a good idea.

On Tue, Jan 24, 2017 at 4:21 PM, Peter Thatcher <[email-masked]>
wrote:

> Our implementation of ICE has a type of candidate called "SSLTCP" which
> does a fake TLS handshake to get through firewalls that only allow TLS
> connections.  We've been using it for years.  And I'm guessing some of our
> web products would appreciate that being in other browsers as well, so we
> may be interested in seeing it as part of the standard (or a less fake
> version of it).  But I don't have any stats about how often those work but
> normal TCP candidates don't, so I can't say for sure how useful it really
> is.

---

From: Bernard Aboba <[email-masked]>
Date: Fri, 17 Feb 2017 13:55:37 -0800

I have read this draft, and like it.  In practice there are enough
customers restricting connectivity via UDP or TLS to make it worthwhile to
implement TLS candidates.

My experience is that customers who only allow TLS to port 443 also tend to
impose other restrictions, such as forcing connections through an HTTPS
proxy of some kind.  So the considerations discussed in Section 6 are quite
important.

On Mon, Jan 23, 2017 at 11:28 AM, Pal Martinsen (palmarti) <
[email-masked]> wrote:

> Hi all,
>
> There is a need for TLS candidates. We did an implementations, so we
> thought is was a good idea to write up a draft.
>
> Is this something others are interested in as well?
> (As there seems to be no ICE meeting next IETF it would be nice to get the
> discussion started on the list)
>
> .-.
> Pål-Erik
>
> Begin forwarded message:
>
> *From: *<[email-masked]>
> *Subject: **New Version Notification for
> draft-martinsen-ice-tls-candidates-00.txt*
> *Date: *20 January 2017 at 14:08:09 GMT+1
> *To: *Nathan Buckles <[email-masked]>, Paal-Erik Martinsen <
> [email-masked]>
>
>
> A new version of I-D, draft-martinsen-ice-tls-candidates-00.txt
> has been successfully submitted by Paal-Erik Martinsen and posted to the
> IETF repository.
>
> Name: draft-martinsen-ice-tls-candidates
> Revision: 00
> Title: TLS Candidates for ICE
> Document date: 2017-01-20
> Group: Individual Submission
> Pages: 6
> URL:            https://www.ietf.org/internet-drafts/draft-
> martinsen-ice-tls-candidates-00.txt
> Status:         https://datatracker.ietf.org/doc/draft-martinsen-
> ice-tls-candidates/
> Htmlized:       https://tools.ietf.org/html/draft-martinsen-ice-tls-
> candidates-00
>
>
> Abstract:
>   This document introduces TLS candidates to ICE.
>
>
>
>
> Please note that it may take a couple of minutes from the time of
> submission
> until the htmlized version and diff are available at tools.ietf.org.
>
> The IETF Secretariat
>
>
>
> _______________________________________________
> Ice mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ice
>
>