1

https://en.wikipedia.org/wiki/HTTP/2

I know that a HTTPS connection provides:

  • Authenticity: a website that I'm visiting is the real website that I intended to visit.
  • Integrity: the data that is sent between the two endpoint is not altered
  • Encryption: the data that is sent between the two endpoint is encrypted

The question: But what about TLS used in the HTTP/2 RFC? Does it mean the same? Could we finally ditch the CA system if HTTP/2 would provide only connection via TLS?

4

"HTTPS" is "HTTP-within-SSL" (now, SSL evolves under the name "TLS" but that's the same thing). HTTP/2 is nothing special here, except in that it makes TLS somehow mandatory; in other words, when (if) HTTP/2 becomes an actual thing, all sites using it will be HTTPS sites.

From the TLS point of view, these are just bytes. TLS does not know or care whether the transported bytes actually encode HTTP/1.1 requests, HTTP/2 requests, or anything else.

The "CA system" is linked to TLS, not to HTTP. HTTP/2 changes nothing in that respect. What could "ditch the CA system" would be DANE, and this would apply equally to "normal HTTP" and HTTP/2 (and it would not really remove all CA, despite the propaganda; it would merge CA with domain registrars, which would more amount to a change of players rather than removal of the CA concept).

  • TLS is not outright mandatory there has been a lot of discussion on this. Anyhow HTTP2 via Wikipedia "Earlier, encryption method TLS 1.2 or greater was planned to be mandatory as part of the protocol.[15] However, in lieu of consensus for mandatory TLS, an optional unencrypted mode exists in addition to required support of an encrypted mode." – munkeyoto Nov 4 '14 at 20:28
  • The text means that some people insist on being formally allowed to do some HTTP/2 over plain TCP without a TLS layer. However, Firefox and Chrome already decided not to support non-TLS HTTP/2, so life will be hard for sites that use HTTP/2 without TLS. Hence my "somehow mandatory". – Tom Leek Nov 4 '14 at 20:34
1

It's the same thing. We couldn't ditch CAs because CAs are a necessary part of the trust system. You can't trust any hosts if you don't have someone out there verifying that hosts actually are who they say they are. You need a basis of trust in PKI and SSL doesn't work well if you have no infrastructure to verify details of site operators.

The point of HTTP/2 is to improve system performance of the web, not something security related (aside from the proposal to allow for proxies to act as middle men on encrypted connection with user permission without throwing trust errors. Even that is performance related rather than security related though.)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.