No support for TLS 1.3? Any reason for this, other than work?
TLS 1.3 is too "modern".
Rustls: new, modern TLS library written in Rust
11–20 of 112 posts
Re: Rustls: new, modern TLS library written in Rust
#12I'm developing a twitch whenever I see the word "modern" in a software description. It doesn't actually say anything about what you're doing.
> The following things are broken, obsolete, badly designed, underspecified, dangerous and/or insane. Rustls does not support [...]
I'd love to see an explanation for not supporting client authentication. Also, completely ruling out discrete-log DH and requiring PFS is not feasible unless you want to rule out a lot of clients and servers, on top of not supporting TLS 1.1.
Re: Rustls: new, modern TLS library written in Rust
#13I'm developing a twitch whenever I see the word "modern" in a software description. It doesn't actually say anything about what you're doing.
> The following things are broken, obsolete, badly designed, underspecified, dangerous and/or insane. Rustls does not support [...]
That comment is intended to say that Rustls doesn't support the things in the list below because the technologies in that list are broken, not because Rustls itself is broken. So the authors have chosen just not to implement anything in that list.
Re: Rustls: new, modern TLS library written in Rust
#14Earlier quoted context omitted.
> The following things are broken, obsolete, badly designed, underspecified, dangerous and/or insane. Rustls does not support [...]
That comment is intended to say that Rustls doesn't support the things in the list below because the technologies in that list are broken, not because Rustls itself is broken. So the authors have chosen just not to implement anything in that list.
Right, hence "modern".
Re: Rustls: new, modern TLS library written in Rust
#15Earlier quoted context omitted.
> The following things are broken, obsolete, badly designed, underspecified, dangerous and/or insane. Rustls does not support [...]
I'd love to see an explanation for not supporting client authentication. Also, completely ruling out discrete-log DH and requiring PFS is not feasible unless you want to rule out a lot of clients and servers, on top of not supporting TLS 1.1.
I've never even heard of client authentication until recently. That's probably why.
Re: Rustls: new, modern TLS library written in Rust
#16Earlier quoted context omitted.
> C: doesn't do weird stuff like bypassing malloc(), avoids undefined behavior. Can you elaborate?
It's a bit of a naive comment, because it wholly depends on the libraries you include and what those do. Use any of the debugging libraries that shim in their own alloc routines, you bypass malloc (or at least do a bunch of things that impact what gets malloc'd).
Sure, but those libraries exist for the explicit purpose of giving malloc() special behavior. I'm talking about general-purpose libraries that implement their own malloc(), thereby preventing the use of these malloc()-hooking libraries.
Re: Rustls: new, modern TLS library written in Rust
#17Earlier quoted context omitted.
I'd love to see an explanation for not supporting client authentication. Also, completely ruling out discrete-log DH and requiring PFS is not feasible unless you want to rule out a lot of clients and servers, on top of not supporting TLS 1.1.
I've never even heard of client authentication until recently. That's probably why.
Obscure is not on the list in GP's quote, and afaik client authentication is none of the things in that list. It's actually used a fair bit in uses of TLS that are not the open web.
Re: Rustls: new, modern TLS library written in Rust
#18Earlier quoted context omitted.
I've never even heard of client authentication until recently. That's probably why.
Obscure is not on the list in GP's quote, and afaik client authentication is none of the things in that list. It's actually used a fair bit in uses of TLS that are not the open web.
Yes. I've implemented client-auth with a private CA, specifically to authenticate services to each other.
It's a very handy tool when you have disparate networks.
Re: Rustls: new, modern TLS library written in Rust
#19Earlier quoted context omitted.
I'd love to see an explanation for not supporting client authentication. Also, completely ruling out discrete-log DH and requiring PFS is not feasible unless you want to rule out a lot of clients and servers, on top of not supporting TLS 1.1.
I've never even heard of client authentication until recently. That's probably why.
If you've ever used OpenVPN, you've used TLS client authentication. That seems like a pretty huge hole to purposely put in your feature set. I understand not implementing it yet because it's more work, but I don't get drawing a line in the sand.
Re: Rustls: new, modern TLS library written in Rust
#20I wonder, will Servo use this?