From f97082d162912524d417239b2b143fb52430cf7d Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Mon, 3 Dec 2012 20:35:22 +0100 Subject: added web --- manual/html_node/Separate-ports.html | 201 +++++++++++++++++++++++++++++++++++ 1 file changed, 201 insertions(+) create mode 100644 manual/html_node/Separate-ports.html (limited to 'manual/html_node/Separate-ports.html') diff --git a/manual/html_node/Separate-ports.html b/manual/html_node/Separate-ports.html new file mode 100644 index 0000000000..f0b8ba7b5c --- /dev/null +++ b/manual/html_node/Separate-ports.html @@ -0,0 +1,201 @@ + + + + + +GnuTLS 3.1.5: Separate ports + + + + + + + + + + + + + + + + + + + + +
+

+Next: , Up: How to use TLS in application protocols   [Contents][Index]

+
+
+ +

3.7.1 Separate ports

+ +

Traditionally SSL was used in application protocols by +assigning a new port number for the secure services. That way two +separate ports were assigned, one for the non secure sessions, and one +for the secured ones. This has the benefit that if a user requests a +secure session then the client will try to connect to the secure port +and fail otherwise. The only possible attack with this method is a +denial of service one. The most famous example of this method is the +famous “HTTP over TLS” or HTTPS protocol [RFC2818]. +

+

Despite its wide use, this method is not as good as it seems. This +approach starts the TLS Handshake procedure just after the +client connects on the —so called— secure port. That way the +TLS protocol does not know anything about the client, and +popular methods like the host advertising in HTTP do not +work6. There is no way for the client to say “I +connected to YYY server” before the Handshake starts, so the server +cannot possibly know which certificate to use. +

+

Other than that it requires two separate ports to run a single +service, which is unnecessary complication. Due to the fact that there +is a limitation on the available privileged ports, this approach was +soon obsoleted. +

+
+
+

Footnotes

+ +

(6)

+

See also the Server Name Indication extension on +serverind.

+
+ + + + + -- cgit v1.2.1