TLS ALPN Proposal v5

[Simone Bordet]

Hi,

On Fri, Sep 25, 2015 at 7:23 PM, David M. Lloyd <david.lloyd at redhat.com> wrote:
> The application protocol implementation chooses only valid cipher suites for
> the protocol.  Why would it choose one that is not valid, considering that
> the protocol implementation itself is the only thing that "knows" what is
> valid or not?

The cipher could fail for the number of reasons it fails in
trySetCipherSuite(), even if the application has chosen the right
combination of (application protocol, cipher, whatever else).
At that point you have to try another application protocol.

> This validation should have happened before the JDK ever has a chance to be
> involved.

See above.
Unless it is verified that trySetCipherSuite() cannot *ever* fail
after a cipher has been chosen (but then the method should return
void), then I don't see how your proposal could work.

Have you written an implementation already ? That would help.

-- 
Simone Bordet
http://bordet.blogspot.com
---
Finally, no matter how good the architecture and design are,
to deliver bug-free software with optimal performance and reliability,
the implementation technique must be flawless.   Victoria Livschitz