Subject: [CDNi] HTTPS in interconnected CDNs

From: <[email-masked]>
Date: Wed, 18 Mar 2015 14:03:35 +0000

Hello fellow IETFers,

If you have read the CDNI agenda posted today, you might be wondering what the last topic is all about. Indeed, I have given some attention to the HTTPS surge that we've been lately seeing on the network and it occurred to me that this is something to be discussed within the CDNI working group. So far, the group has been concentrating only on delivery of HTTP traffic in the clear, so the reasonable action seemed to bring up HTTPS and discuss it in Dallas.

There are a few ideas that I'd like us to debate and they revolve around the following:

1.       Is this the right working group to tackle HTTPS in interconnected CDNs? (there are a lot of hallway conversations going on and some other working groups might want to be involved)

2.       What are the technical ways to achieve this? A few methods are known in the industry, maybe we could start by doing an inventory of what is available? Is it possible to rely on the existing CDNI interfaces and expand them to support delegation of HTTPS content (Metadata comes to mind)?

3.       If the working group decides to take up the work, what would be the future steps and the goals?

Your feedback is highly appreciated,
--iuniana

_________________________________________________________________________________________________________________________

Ce message et ses pieces jointes peuvent contenir des informations confidentielles ou privilegiees et ne doivent donc
pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu ce message par erreur, veuillez le signaler
a l'expediteur et le detruire ainsi que les pieces jointes. Les messages electroniques etant susceptibles d'alteration,
Orange decline toute responsabilite si ce message a ete altere, deforme ou falsifie. Merci.

This message and its attachments may contain confidential or privileged information that may be protected by law;
they should not be distributed, used or copied without authorisation.
If you have received this email in error, please notify the sender and delete this message and its attachments.
As emails may be altered, Orange is not liable for messages that have been modified, changed or falsified.
Thank you.

---

From: Ben Niven-Jenkins <[email-masked]>
Date: Thu, 19 Mar 2015 06:41:01 +0000

Hi Iuniana,

Regarding your question number 2. It should be possible to support delegation of HTTPS content using extensions to the existing CDNI interfaces.

A while ago Mal, Rob & I wrote a draft[1] illustrating how the metadata interface (as it was defined at the time) could be extended to support HTTPS. Our motivation was to see if extending the metadata interface with new metadata was feasible as a "test" so the draft is not complete, for example it does not secure the private keys in any way.

We took the simple approach of distributing the necessary metadata & keys but depending on the content provider's and uCDN's appetite for sharing private keys with dCDNs, an approach that used Keyless SSL[2] and distributed the metadata required for that might be more appropriate.

Depending on the type of redirection required the redirection interface may need extending as well, e.g. by defining a https dictionary that is similar/identical to the existing http dictionary, although I suspect most uses of HTTPS would use DNS redirection.

Other are probably better placed to comment on any impacts to the other CDNI interfaces.

HTH
Ben

[1] https://tools.ietf.org/html/draft-hubert-cdni-https-metadata-00
[2] https://blog.cloudflare.com/keyless-ssl-the-nitty-gritty-technical-details/

> On 18 Mar 2015, at 14:03, <[email-masked]> <[email-masked]> wrote:
> 
> Hello fellow IETFers,
>  
> If you have read the CDNI agenda posted today, you might be wondering what the last topic is all about. Indeed, I have given some attention to the HTTPS surge that we’ve been lately seeing on the network and it occurred to me that this is something to be discussed within the CDNI working group. So far, the group has been concentrating only on delivery of HTTP traffic in the clear, so the reasonable action seemed to bring up HTTPS and discuss it in Dallas.
>  
> There are a few ideas that I’d like us to debate and they revolve around the following:
> _______________________________________________
> CDNi mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/cdni