Re: TLS in Gopher

["Iain R. Learmonth" <irl@fsfe.org>]

Hi,

On 01/03/18 11:05, Alex Schröder wrote:
> Just to put a final nail into STARTTLS: https://tools.ietf.org/html/rfc8314
> is about email but the principle is the same.

The principle is *not* the same. For SMTP, the server sends data (the
banner) first as it can't know what the client is doing. For Gopher, the
client talks first and then the server can respond either using or not
using TLS based on what the client has sent.

STARTTLS was needed because the server would have already sent plaintext
to the client before it knew the client wanted TLS and would mess up the
handshake. This wouldn't happen for Gopher.

Thanks,
Iain.