envoyproxy/envoy

Enable TLS 1.3 on the client-side by default

Open

#9,300 opened on Dec 10, 2019

View on GitHub
 (14 comments) (10 reactions) (0 assignees)C++ (5,373 forks)batch import
area/tlshelp wanted

Repository metrics

Stars
 (27,997 stars)
PR merge metrics
 (Avg merge 8d) (378 merged PRs in 30d)

Description

Currently, TLS 1.3 is NOT enabled by default on the client-side, because the handshake changed a bit in TLS 1.3, and is considered completed on the client-side as soon as the requested client certificate is sent, i.e. before server validates the presented client certificate. This means that the client-side transport socket reports connection as established, and the client starts sending data without knowing if the server is going to accept the client certificate, which makes handling failures a bit tricky with respect to retries and buffering, and makes enabling TLS 1.3 on client-side significantly more difficult than simply changing the maximum supported protocol version.

cc @mattklein123 @lizan @derekargueta

Contributor guide

Research direction
Study the current TLS 1.3 handshake implementation on the client side, understand the early data and retry mechanisms, and design a solution that safely enables TLS 1.3 by default while handling potential certificate rejection.
Tech stack
cpp
Domain
backendsecurity
Issue type
Feature
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
4
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
1-2 days
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Active
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Clear
Prerequisites
C++TLS
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
25