5 ms·

There are some really cool "tricks" for avoiding the round trip — round trips are why everyone should be using a global load balancer for SSL. Clients have to s

by mrkurt 9y ago

There are some really cool "tricks" for avoiding the round trip — round trips are why everyone should be using a global load balancer for SSL. Clients have to send 2 packets across the world and wait for a reply, which can add >100ms before any actual work happens. http2 helps because you can multiplex a bunch of requests into a single connection, less waiting on new connections to be established. TLS 1.2 with session resumption lets clients reuse existing sessions after the first connection. TLS 1.3 has a 0rtt handshake, which is pretty baller. It's just not widely deployed.

amenghra 9y ago
0rtt is only for resuming sessions. I believe the first handshake won't be any faster with 1.3. Still neat.
- colmmacc 9y ago
  TLS1.3 does speed up non-0RTT handshakes too, at least the ones that use forward secrecy; which is nearly all these days. It reduces them to 1RTT instead of the 2RTT we have today.
nodesocket 9y ago
Any idea when TLS 1.3 will be supported in NGINX? What browsers support it as well?
- a012 9y ago
  The problem is not in Nginx part, you must wait for TLS 1.3 implementation in OpenSSL, LibreSSL, etc.
  - deleted 9y ago
    [deleted]
- detaro 9y ago
  It already is, if you build 1.13 with the right OpenSSL. https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_protocols https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_... https://github.com/tlswg/tls13-spec/wiki/Implementations https://github.com/tlswg/tls13-spec/wiki/Implementations
valarauca1 9y ago
TLS 1.3 has a 0rtt handshake, which is pretty baller. It's just not widely deployed. And it likely won't be. 0RTT Allows for replay attacks (I capture your packets, and replay them). Without a round trip this will always exist. Also 0RTT is only for re-connections not initial connections. The solution is only like 0RTT be executed once and only once, but this isn't part of TLSv1.3 and is waiting to _globally_ approved. Until then nobody smart will touch it. --- 0RTT is only supported by Cloud-Flare and Google. Cloud-Flare makes you track 0RTT yourself so a fair number of sites are insecure. Google does SSL tick synchronization across data centers because their arrogant and is extremely vulnerable to timing att-
- jopsen 9y ago
  Wouldn't 0RTT be safe for GET requests that doesn't contain cookies or private data? Granted I suppose such interpretation would have to be done by browsers. And even then it could be used to figure out which site you are visiting.
  - valarauca1 9y ago
    You are assuming * The TLS connection is instantly closed after the GET ends * A new 0RTT ticket isn't created * No session information is transmitted (most GET's even have session information for ads/metrics).
bogomipz 9y ago
>"There are some really cool "tricks" for avoiding the round trip — round trips are why everyone should be using a global load balancer for SSL. Clients have to send 2 packets across the world and wait for a reply, which can add >100ms before any actual work happens." What is a "global load balancer"? A load balancer doesn't avoid any round trips. The "work" of TLS begins as soon as the client sends a ClientHello which is during the second round trip. On a new connection the total round trips is 4 if you include the GET request. It's 3 round trips if you only consider the TCP hand shake and the TLS handshake. This is true whether there is a load balancer or not.
- TheSwordsman 9y ago
  I assume a load balancing / caching solution that is available on an anycast IP address. The TLS termination happens at the (ideally) closest point of presence (PoP). The idea is to reduce the RTT from client to its termination point. Think CloudFlare CDN or the Google Cloud Load Balancer. Edit Mistyped RTT as TTL.
  - bogomipz 9y ago
    Sure, you can reduce the RTT by moving the edge closer to the eyeballs but that's not the same as avoiding an RTT as the OP stated. That's what all I was commenting on. There are mechanisms however to do that such as sessions tickets/resumption but that's not something specific to load balancers.
    - kelnos 9y ago
      The OP didn't claim using a "global" LB would eliminate round-trips, just that you should use one because of the round trips.
      - bogomipz 9y ago
        The OP stated: >"There are some really cool "tricks" for avoiding the round trip — round trips are why everyone should be using a global load balancer for SSL." "Avoiding" means not incurring them, so yes they did claim a "global" LB would eliminate round trips.
mozumder 9y ago
It would be nice if the DNS lookup also provided the certificate for the site.
- raimue 9y ago
  This is possible with TLSA records as specified by DANE.

by mrkurt 9y ago

amenghra 9y ago

0rtt is only for resuming sessions. I believe the first handshake won't be any faster with 1.3. Still neat.

colmmacc 9y ago
TLS1.3 does speed up non-0RTT handshakes too, at least the ones that use forward secrecy; which is nearly all these days. It reduces them to 1RTT instead of the 2RTT we have today.

nodesocket 9y ago

Any idea when TLS 1.3 will be supported in NGINX? What browsers support it as well?

a012 9y ago
The problem is not in Nginx part, you must wait for TLS 1.3 implementation in OpenSSL, LibreSSL, etc.
- deleted 9y ago
  [deleted]
detaro 9y ago
It already is, if you build 1.13 with the right OpenSSL. https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_protocols https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_... https://github.com/tlswg/tls13-spec/wiki/Implementations https://github.com/tlswg/tls13-spec/wiki/Implementations

valarauca1 9y ago

TLS 1.3 has a 0rtt handshake, which is pretty baller. It's just not widely deployed. And it likely won't be. 0RTT Allows for replay attacks (I capture your packets, and replay them). Without a round trip this will always exist. Also 0RTT is only for re-connections not initial connections. The solution is only like 0RTT be executed once and only once, but this isn't part of TLSv1.3 and is waiting to _globally_ approved. Until then nobody smart will touch it. --- 0RTT is only supported by Cloud-Flare and Google. Cloud-Flare makes you track 0RTT yourself so a fair number of sites are insecure. Google does SSL tick synchronization across data centers because their arrogant and is extremely vulnerable to timing att-

jopsen 9y ago
Wouldn't 0RTT be safe for GET requests that doesn't contain cookies or private data? Granted I suppose such interpretation would have to be done by browsers. And even then it could be used to figure out which site you are visiting.
- valarauca1 9y ago
  You are assuming * The TLS connection is instantly closed after the GET ends * A new 0RTT ticket isn't created * No session information is transmitted (most GET's even have session information for ads/metrics).

bogomipz 9y ago

>"There are some really cool "tricks" for avoiding the round trip — round trips are why everyone should be using a global load balancer for SSL. Clients have to send 2 packets across the world and wait for a reply, which can add >100ms before any actual work happens." What is a "global load balancer"? A load balancer doesn't avoid any round trips. The "work" of TLS begins as soon as the client sends a ClientHello which is during the second round trip. On a new connection the total round trips is 4 if you include the GET request. It's 3 round trips if you only consider the TCP hand shake and the TLS handshake. This is true whether there is a load balancer or not.

TheSwordsman 9y ago
I assume a load balancing / caching solution that is available on an anycast IP address. The TLS termination happens at the (ideally) closest point of presence (PoP). The idea is to reduce the RTT from client to its termination point. Think CloudFlare CDN or the Google Cloud Load Balancer. Edit Mistyped RTT as TTL.
- bogomipz 9y ago
  Sure, you can reduce the RTT by moving the edge closer to the eyeballs but that's not the same as avoiding an RTT as the OP stated. That's what all I was commenting on. There are mechanisms however to do that such as sessions tickets/resumption but that's not something specific to load balancers.
  - kelnos 9y ago
    The OP didn't claim using a "global" LB would eliminate round-trips, just that you should use one because of the round trips.
    - bogomipz 9y ago
      The OP stated: >"There are some really cool "tricks" for avoiding the round trip — round trips are why everyone should be using a global load balancer for SSL." "Avoiding" means not incurring them, so yes they did claim a "global" LB would eliminate round trips.

mozumder 9y ago

It would be nice if the DNS lookup also provided the certificate for the site.

raimue 9y ago
This is possible with TLSA records as specified by DANE.