Is opportunistic encryption support optional for HTTP/2?

Question

I'm a little unclear on the subject of opportunistic encryption of the HTTP:// address scheme in HTTP/2.

According to the bug report, it looks like it's kinda optional, and an afterthought:

https://github.com/http2/http2-spec/issues/315

There's also a FAQ entry:

http://http2.github.io/faq/#does-http2-require-encryption

Does HTTP/2 require encryption?

No. After extensive discussion, the Working Group did not have consensus to require the use of encryption (e.g., TLS) for the new protocol.

However, some implementations have stated that they will only support HTTP/2 when it is used over an encrypted connection.

However, it's unclear how it relates to opportunistic encryption, where implementation would be [kinda] mandatory, but actual support [somewhat] optional.

However, according to IETF "Pervasive Monitoring Is an Attack", Best Current Practice 188, it would seem like opportunistic encryption is supposed to be made mandatory is all protocol designs:

https://www.rfc-editor.org/rfc/rfc7258

Is HTTP/2 being designed in violation of BCP 188, RFC 7258?

Answer 1

Yes, it appears optional. According to http://daniel.haxx.se/blog/2015/03/06/tls-in-http2/, it was originally part of the HTTP/2 specification, but was later moved into its own spec as an extension of HTTP/2, https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-alt-svc-06.

It would appear that it was finally implemented in Mozilla in late 2014, and was finally enabled and will be shipping with Firefox 37.

https://bugzilla.mozilla.org/show_bug.cgi?id=1003448

https://bugzilla.mozilla.org/show_bug.cgi?id=1113790