Subject: [saag] openconnect (ssl) vpn protocol

From: Nikos Mavrogiannopoulos <[email-masked]>
Date: Fri, 23 Sep 2016 11:57:40 +0200

Hi,
 The last few weeks together with David Woodhouse have improved the
openconnect VPN protocol quite significantly and eliminated any legacy
constructs arising from the pre-DTLS era, and pre-TLS-PSK era. Even
though it still provides backwards compatibility with the cisco's
anyconnect protocol, it has been greatly simplified, making it one of
the simplest SSL VPN protocols I'm aware of. It is described at:
https://tools.ietf.org/html/draft-mavrogiannopoulos-openconnect-00

We would appreciate any feedback on the protocol and approach.

regards,
Nikos

---

From: David Woodhouse <[email-masked]>
Date: Fri, 23 Sep 2016 11:04:31 +0100

> We would appreciate any feedback on the protocol and approach.

Did I catch a suggestion that using PSK in (D)TLSv1.3 is going to
require us to pre-agree a hash algorithm for the hello_finished?

-- 
dwmw2