3 ms·
Hi, co-speaker here. Please feel free to ask any questions you have here, or by emailing tls13 at cloudflare. The slide deck is at https://speakerdeck.com/fil
by FiloSottile 10y ago
Hi, co-speaker here.
Please feel free to ask any questions you have here, or by emailing tls13 at cloudflare.
The slide deck is at https://speakerdeck.com/filosottile/tls-1-dot-3-at-33c3 https://speakerdeck.com/filosottile/tls-1-dot-3-at-33c3 (but it's not really made for standalone consumption).
- cesarb 10y agoI have one question. What prevents a Sufficiently Incompetent Implementer from manually ignoring all known GREASE values, while still doing something crazy otherwise?
- davidben 10y agoUltimately we can't do anything about a server that is near-maliciously determined to be wrong. The hope is we can at least defend against some of the common genuine mistakes at fairly low cost. The implementer that tries to special-case GREASE values must have first hit an interop problem and thus had a second or third opportunity to think about it. I would hope, at that point, they realize they're meant to ignore unknown ones!
- kpcyrd 10y agoDo you know of 0-RTT implementation efforts on reverse proxies, say, nginx? Let's say I run a static website and I'm 100% sure unauthenticated GET won't break anything, is there anything special I need to do or is it going to be "enable this flag"? Another question: Can I set 0-RTT per vhost (sni) or do I need dedicated 0-RTT IPs?
- FiloSottile 10y agoThere is no 0-RTT implementation in servers that I know of, except our internal one at Cloudflare, which currently waits for the Finished confirmation until we decide on a policy. The following two questions are of course implementation-specific, but there is nothing in the protocol blocking a "just do 0-RTT" flag or vhost configs.