Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
https://en.wikipedia.org/wiki/HTTP/2
I know that a HTTPS connection provides:
The question: But what about TLS used in the HTTP/2 RFC? Does it mean the same? Could we finally ditch the CA system if HTTP/2 would provide only connection via TLS?
"HTTPS" is "HTTP-within-SSL" (now, SSL evolves under the name "TLS" but that's the same thing). HTTP/2 is nothing special here, except in that it makes TLS somehow mandatory; in other words, when (if) HTTP/2 becomes an actual thing, all sites using it will be HTTPS sites.
From the TLS point of view, these are just bytes. TLS does not know or care whether the transported bytes actually encode HTTP/1.1 requests, HTTP/2 requests, or anything else.
The "CA system" is linked to TLS, not to HTTP. HTTP/2 changes nothing in that respect. What could "ditch the CA system" would be DANE, and this would apply equally to "normal HTTP" and HTTP/2 (and it would not really remove all CA, despite the propaganda; it would merge CA with domain registrars, which would more amount to a change of players rather than removal of the CA concept).
It's the same thing. We couldn't ditch CAs because CAs are a necessary part of the trust system. You can't trust any hosts if you don't have someone out there verifying that hosts actually are who they say they are. You need a basis of trust in PKI and SSL doesn't work well if you have no infrastructure to verify details of site operators.
The point of HTTP/2 is to improve system performance of the web, not something security related (aside from the proposal to allow for proxies to act as middle men on encrypted connection with user permission without throwing trust errors. Even that is performance related rather than security related though.)
