TLS False Start?

[sna...@gmail.com]

GoLang 1.6 has HTTPv2 and that requires TLS. 

False Start makes TLS handshakes more efficient, but I see no information about if GoLang supports it. 

In the interest of increasing HTTPv2 adoption, has this efficiency been investigated?

[Nigel Tao]

I'd ask agl or bradfitz (CC'ed).

[Brad Fitzpatrick]

Adam wrote about this:

https://www.imperialviolet.org/2012/04/11/falsestart.html

But it's been some time and NPN/ALPN are much more prevalent nowadays, I'd suspect.

Adam?

[Andy Jackson]

So enabling it for servers is always acceptable, but for clients it should be a enabled during NPN and remembered like Chrome & Firefox do.

It's also safe in a micro-services environment where respondents are Go servers.

Thanks for considering it,
Andrew Jackson.

[Adam Langley]

On Thu, Jan 28, 2016 at 7:24 PM, Andy Jackson <sna...@gmail.com> wrote:
>
> So enabling it for servers is always acceptable, but for clients it should be a enabled during NPN and remembered like Chrome & Firefox do.
>
> It's also safe in a micro-services environment where respondents are Go servers.
>
> Thanks for considering it,

I'm not sure whether any servers have actually tried using False
Start. I've only ever written it for clients.

It could be done in Go, although it would make the code a little more
complex so it certainly has its costs too. Keep in mind that the
latency of False Start is the same as a TLS resumption so making sure
that your servers and clients get resumption right should be the first
priority in this area. False Start mostly helps clients that talk to
lots of different servers, many of which aren't well configured (i.e.
browsers).


Cheers

AGL

[ch...@catlover.com]

false start is overkill. i'd rather absorb the latency costs of one round trip during the handshake - it is not worth the risks. same goes for tls renegotiation, I'd rather tear down the connection and reestablish it.

[Igor Gatis]

Say you have thousands of devices which you have control over. They all use GPRS (2G), with ~700ms of latency. TLS handshake may cost ~4s sometimes when mobile coverage is good and astonishing 20s when it is not or packet loss is high by any reason.

False Start could make a huge difference.

How do I enable False Start on my Go reverse proxy (Window Server 2012) and go client running on linux 2.6 on an ARM? (Bonus: C++ client with libcurl and linux like OS)?

[Igor Gatis]

Ping. I could not find any info on how to turn on TLS False Start support. Help.