1

I'm a little unclear on the subject of opportunistic encryption of the HTTP:// address scheme in HTTP/2.

According to the bug report, it looks like it's kinda optional, and an afterthought:

https://github.com/http2/http2-spec/issues/315

There's also a FAQ entry:

http://http2.github.io/faq/#does-http2-require-encryption

Does HTTP/2 require encryption?

No. After extensive discussion, the Working Group did not have consensus to require the use of encryption (e.g., TLS) for the new protocol.

However, some implementations have stated that they will only support HTTP/2 when it is used over an encrypted connection.

However, it's unclear how it relates to opportunistic encryption, where implementation would be [kinda] mandatory, but actual support [somewhat] optional.

However, according to IETF "Pervasive Monitoring Is an Attack", Best Current Practice 188, it would seem like opportunistic encryption is supposed to be made mandatory is all protocol designs:

http://tools.ietf.org/html/rfc7258

Is HTTP/2 being designed in violation of BCP 188, RFC 7258?

  • "it would seem like opportunistic encryption is supposed to be made mandatory is all protocol designs" -- Needs to be considered but is not mandatory. From RFC 7258: "Those developing IETF specifications need to be able to describe how they have considered PM, and, if the attack is relevant to the work to be published, be able to justify related design decisions.". – Daniel Apr 7 '15 at 16:11
1

Yes, it appears optional. According to http://daniel.haxx.se/blog/2015/03/06/tls-in-http2/, it was originally part of the HTTP/2 specification, but was later moved into its own spec as an extension of HTTP/2, http://tools.ietf.org/html/draft-ietf-httpbis-alt-svc-06.

It would appear that it was finally implemented in Mozilla in late 2014, and was finally enabled and will be shipping with Firefox 37.

https://bugzilla.mozilla.org/show_bug.cgi?id=1003448

https://bugzilla.mozilla.org/show_bug.cgi?id=1113790

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.