The Illustrated TLS Connection

#1

Post by thamizhan2611 » Sat, Aug 15, 2020, 10:42 AM UTC

The Illustrated TLS Connection
tls.ulfheim.net

Re: The Illustrated TLS Connection

#2

Post by gwittel » Sun, Aug 16, 2020, 3:14 AM UTC

It’s a lovely guide. Saves a lot of time vs reading the RFCs when you just want to debug a session state flow/log/packet capture.

The one thing I wish it had was better tracing of branch points like session resumption. It would make walking session state logs simpler.

I ran into this while trying to figure out if the open source Kubernetes nginx ingress supported session resumption on the upstream side (it doesn’t; a deficiency in the lua balancer). While the diversion into nginx source and other sundries was nice, I could have saved that time :)

Re: The Illustrated TLS Connection

#3

Post by cordite » Sun, Aug 16, 2020, 3:37 AM UTC

That was absolutely fantastic.

It’d be a pleasure to see a version for 1.3, but not all Maintained SSL libraries implement it yet, https://github.com/ARMmbed/mbedtls/issues/508 mbedTLS tls for example appears not to have it landed. This is one library often used in IoT environments

Re: The Illustrated TLS Connection

#4

Post by kuharich » Sun, Aug 16, 2020, 4:25 AM UTC

Prior comments: https://news.ycombinator.com/item?id=18200749

Re: The Illustrated TLS Connection

#5

Post by toast0 » Sun, Aug 16, 2020, 5:44 AM UTC

cordite wrote: post #3

That was absolutely fantastic. It’d be a pleasure to see a version for 1.3, but not all Maintained SSL libraries implement it yet, https://github.com/ARMmbed/mbedtls/issues/508 mbedTLS tls for example appears not to have it landed. This is one library often used in IoT environments

> It’d be a pleasure to see a version for 1.3

https://tls13.ulfheim.net/ (linked at the bottom)

Re: The Illustrated TLS Connection

#6

Post by mlk » Sun, Aug 16, 2020, 11:47 AM UTC

One including mutual authentication would be appreciated

Re: The Illustrated TLS Connection

#7

Post by cordite » Mon, Aug 17, 2020, 5:19 PM UTC

toast0 wrote: post #5

cordite wrote: post #3

That was absolutely fantastic. It’d be a pleasure to see a version for 1.3, but not all Maintained SSL libraries implement it yet, https://github.com/ARMmbed/mbedtls/issues/508 mbedTLS tls for example appears not to have it landed. This is one library often used in IoT environments

> It’d be a pleasure to see a version for 1.3 https://tls13.ulfheim.net/ (linked at the bottom)

Thanks! I totally missed it.

I find it silly how many places legacy versions are hard coded for compatibility.

Re: The Illustrated TLS Connection

#8

Post by toast0 » Wed, Aug 19, 2020, 7:22 AM UTC

cordite wrote: post #7

toast0 wrote: post #5

Earlier quoted context omitted.

> It’d be a pleasure to see a version for 1.3 https://tls13.ulfheim.net/ (linked at the bottom)

Thanks! I totally missed it. I find it silly how many places legacy versions are hard coded for compatibility.

As I recall, this came out right on the cusp of TLS 1.3; so TLS 1.2 was what was currently deployed. Timing was awful for me, because I was working on a TLS 1.3 project, and this would have been super useful, but wasn't yet available.