Subject: Re: [Netconf] Fw: Last Call: <draft-ietf-tls-applayerprotoneg-03.txt> (Transport Layer Security (TLS) Application Layer Protocol Negotiation Extension) to Proposed Standard

From: Randy Presuhn <[email-masked]>
Date: Sat, 14 Dec 2013 01:03:29 -0800 (GMT-08:00)

Hi -

>From: Mohamad Badra <[email-masked]>
>Sent: Dec 13, 2013 3:08 PM
>To: Randy Presuhn <[email-masked]>
>Cc: "[email-masked]" <[email-masked]>
>Subject: Re: [Netconf] Fw: Last Call: <draft-ietf-tls-applayerprotoneg-03.txt> (Transport Layer Security (TLS) Application Layer Protocol Negotiation Extension) to Proposed Standard
...
>> Seems directly applicable to 5539bis, reducing or possibly eliminating
>> the need for a separate port.
>
>
>
>​But there is already a port assigned for NETCONF over TLS since years.

By using a single port for multiple types of (encrypted)
traffic, traffic analysis attacks, such as those associated
with pervasive monitoring, may be made somewhat more difficult.

Randy

---

From: Mohamad Badra <[email-masked]>
Date: Sat, 14 Dec 2013 14:51:06 +0400

On Sat, Dec 14, 2013 at 1:03 PM, Randy Presuhn <[email-masked]
> wrote:

> >Subject: Re: [Netconf] Fw: Last Call:
> <draft-ietf-tls-applayerprotoneg-03.txt> (Transport Layer Security (TLS)
> Application Layer Protocol Negotiation Extension) to Proposed Standard
> ...

This is currently not provided by the draft. The client sends a list of
applications type in a TLS extension and the server selects ONLY one from
the list. Moreover, the negotiation of application types is achieved in
clear text and available for traffic analysis and monitoring.

It is true that multiple type of traffic could be negotiated (in clear
text) but only one type will use the TLS session.

Best regards,
Badra​​