141–142 of 142 posts
Earlier quoted context omitted.
Istio would not only do TLS, but would also do QUIC for you in the scenario you describe.
You're right, but it would provide a permanent use for regular old TCP connections (which means the answer to the article's question would still be no).
Earlier quoted context omitted.
> By the way, does anyone know why QUIC specifically put NewReno as its official congestion control [0]? Different environments benefit from different algorithms so I don't see why. It's a "reasonable default", in the sense that it normally works quite well, and is easy to implement. The dangerous thing about congestion control is that it's really easy to get it wrong and not notice (as noticing requires performance…
Thanks for the information; your link was an interesting read. > I'm actually curious what use cases you have in mind. TLS certs can be a hassle for peer-to-peer type stuff. I'm currently working on a project that does encrypted file transfer between two people and uses a PAKE instead, because I can encode 32 bits of random data in 3 words and that's plenty versus having to deal with public-key infrastructure or deal…
From my perspective that's very generous. All the flags and extensions in x509 certs seem to have one use: provide a way for the companies who run the PKI infrastructure to extract more money. I am perhaps to being a little harsh here, as some like the ability to sign sub-certs are absolutely necessary to PKI.
However, outside of PKI, almost none of it adds any security. But they do add enormous amounts of complexity. To take but one example from StrongSwan:
> In addition to serverAuth the 'IP Security IKE Intermediate' EKU with OID 1.3.6.1.5.5.8.2.2 does not hurt either and will allow you to use the certificate with older Mac OS X releases too.
How much does 1.3.6.1.5.5.8.2.2 or indeed any of the extensions add to IPSec security: none. Yet woe betide you if you miss it and someone attempt to use your IPSec implementation from an older OSx. But if you try to work around that by providing every extension under the sun, Windows will reject it. So you end up walking this tightrope of trying to find the magic combination that works with everything.
The option to use TLS without the x509 baggage would be a breath of fresh air.