Mandate HTTPS #165
Merged
Mandate HTTPS #165
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Closes ietf-wg-ohai#155.
LPardue
approved these changes
Aug 9, 2022
chris-wood
reviewed
Aug 9, 2022
| @@ -726,6 +726,12 @@ In this section, a deployment where there are three entities is considered: | |||
| * A relay operates the Oblivious Relay Resource | |||
| * A server operates both the Oblivious Gateway Resource and the Target Resource | |||
|
|
|||
| Connections between the client, Oblvious Relay Resource, and Oblivious Gateway | |||
| Resource MUST use HTTPS in order to provide unlinkability in the presence of a | |||
| network observer. The scheme of the encapsulated request detemrines what is | |||
There was a problem hiding this comment.
In case it's helpful, the analysis showed that HTTPS is only needed between client and relay to achieve this property. But we're mandating it on both sides because it's just good practice.
chris-wood
approved these changes
Aug 9, 2022
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
The text noted in #155 was correct, but we didn't have a single place where we outlined this as a direct requirement.
The day where HTTP presupposes TLS has come for some, but not all of us. Until then, we can be more careful.
Closes #155.