Re: [arch-d] Off topic [was: IAB Statement on Encryption and Mandatory Client-side Scanning of Content]

Phillip Hallam-Baker <phill@hallambaker.com> Tue, 19 December 2023 22:30 UTC

MIME-Version: 1.0
References: <170266952162.33107.14325064798861197261@ietfa.amsl.com> <6.2.5.6.2.20231216110256.18d0acd0@elandnews.com> <CWXP265MB5153610FBB98A7B06AF81040C290A@CWXP265MB5153.GBRP265.PROD.OUTLOOK.COM> <CAKr6gn2Hf4N+DgKHKyO+i3T3OJyYRBJhH1AdQf-uXZ0xKmJ4Eg@mail.gmail.com> <CWXP265MB515381523714FF99524410CFC290A@CWXP265MB5153.GBRP265.PROD.OUTLOOK.COM> <790032a6-24f6-60d1-fb60-4b44bd447bde@gmail.com> <fadd9250-4b31-4bf5-aa76-4f37d24fd650@cdt.org> <02ae01da31f2$80580630$81081290$@olddog.co.uk> <c96e396d-fc05-4bdd-a047-012cbf7366c1@cdt.org> <CAFvDQ9ouHUpn8PqcNLxT0yKGh+mPeOZE_g7a8Nz+rOzEViVL=g@mail.gmail.com> <e9f0c20a-f06c-eb8c-3261-b9c5a7f21b5f@gmail.com>
In-Reply-To: <e9f0c20a-f06c-eb8c-3261-b9c5a7f21b5f@gmail.com>
From: Phillip Hallam-Baker <phill@hallambaker.com>
Date: Tue, 19 Dec 2023 17:29:41 -0500
Message-ID: <CAMm+LwhsEAo=E_x2DLupzGWGou1z1vQEEUiG77oGvxx0QwRaCw@mail.gmail.com>
To: Brian E Carpenter <brian.e.carpenter@gmail.com>
Cc: Hesham ElBakoury <helbakoury@gmail.com>, architecture-discuss@ietf.org
Content-Type: multipart/alternative; boundary="000000000000cb2778060ce467c0"
Archived-At: <https://mailarchive.ietf.org/arch/msg/architecture-discuss/HHD14derxl8NqR5MyGnG-H2ctHo>
Subject: Re: [arch-d] Off topic [was: IAB Statement on Encryption and Mandatory Client-side Scanning of Content]
Precedence: list

On Tue, Dec 19, 2023 at 5:00 PM Brian E Carpenter <
brian.e.carpenter@gmail.com> wrote:

> Hesham,
> On 19-Dec-23 11:59, Hesham ElBakoury wrote:
>
> > Nubeva has developed technology to extract TLS keys to be used by 3rd
> party tools to decrypt and inspect the traffic [
> https://www.nubeva.com/hubfs/Downloadables/Nubeva%20SSL%20Solution%20Brief_Nov%202019.pdf
> ].
> >
> > Would this violates client privacy?
> >
>
> I may be missing something, but I don't understand how this product could
> work unless the "Sensor" component is configured with the server's private
> keys. Is that correct?
>

Not if the client or the server is leaking the session keys in-band.

There is no statement to the effect that it doesn't require endpoint
modification.

This sort of mechanism is deployed inside environments like process control
where you don't want to have any communications that can't be monitored. An
engineer trying to work out what is happening on a nuclear site has to be
able to read absolutely every piece of traffic on the SCADA network.

Re: [arch-d] IAB Statement on Encryption and Mand… S Moonesamy
Re: [arch-d] IAB Statement on Encryption and Mand… Brian E Carpenter
Re: [arch-d] IAB Statement on Encryption and Mand… S Moonesamy
Re: [arch-d] IAB Statement on Encryption and Mand… S Moonesamy
Re: [arch-d] IAB Statement on Encryption and Mand… George Michaelson
Re: [arch-d] IAB Statement on Encryption and Mand… Brian E Carpenter
Re: [arch-d] IAB Statement on Encryption and Mand… Vittorio Bertola
Re: [arch-d] IAB Statement on Encryption and Mand… Christian Huitema
Re: [arch-d] IAB Statement on Encryption and Mand… Eric Rescorla
Re: [arch-d] IAB Statement on Encryption and Mand… Andrew Campling
Re: [arch-d] IAB Statement on Encryption and Mand… Andrew Campling
Re: [arch-d] IAB Statement on Encryption and Mand… S Moonesamy
Re: [arch-d] IAB Statement on Encryption and Mand… Brian E Carpenter
Re: [arch-d] IAB Statement on Encryption and Mand… Wes Hardaker
Re: [arch-d] IAB Statement on Encryption and Mand… Hesham ElBakoury
Re: [arch-d] IAB Statement on Encryption and Mand… S Moonesamy
Re: [arch-d] IAB Statement on Encryption and Mand… S Moonesamy
Re: [arch-d] IAB Statement on Encryption and Mand… Eliot Lear
Re: [arch-d] IAB Statement on Encryption and Mand… Eric Rescorla
[arch-d] Off topic [was: IAB Statement on Encrypt… Brian E Carpenter
Re: [arch-d] IAB Statement on Encryption and Mand… Phillip Hallam-Baker
Re: [arch-d] IAB Statement on Encryption and Mand… Eric Rescorla
Re: [arch-d] IAB Statement on Encryption and Mand… Arnaud Taddei
Re: [arch-d] Off topic [was: IAB Statement on Enc… Phillip Hallam-Baker
Re: [arch-d] IAB Statement on Encryption and Mand… Phillip Hallam-Baker
Re: [arch-d] [EXTERNAL] Re: IAB Statement on Encr… Tommy Jensen
Re: [arch-d] Off topic [was: IAB Statement on Enc… Phillip Hallam-Baker
Re: [arch-d] IAB Statement on Encryption and Mand… Eric Rescorla
Re: [arch-d] IAB Statement on Encryption and Mand… Phillip Hallam-Baker
Re: [arch-d] IAB Statement on Encryption and Mand… Phillip Hallam-Baker
Re: [arch-d] IAB Statement on Encryption and Mand… Mallory Knodel
Re: [arch-d] IAB Statement on Encryption and Mand… Mallory Knodel
Re: [arch-d] IAB Statement on Encryption and Mand… Phillip Hallam-Baker
Re: [arch-d] IAB Statement on Encryption and Mand… Mallory Knodel
Re: [arch-d] IAB Statement on Encryption and Mand… Adrian Farrel
Re: [arch-d] IAB Statement on Encryption and Mand… Mallory Knodel
Re: [arch-d] Off topic [was: IAB Statement on Enc… Hesham ElBakoury
Re: [arch-d] Off topic [was: IAB Statement on Enc… Brian E Carpenter
Re: [arch-d] IAB Statement on Encryption and Mand… Vittorio Bertola
Re: [arch-d] IAB Statement on Encryption and Mand… John Levine
Re: [arch-d] IAB Statement on Encryption and Mand… Mirja Kuehlewind (IETF)
Re: [arch-d] [IAB] IAB Statement on Encryption an… Mirja Kuehlewind (IETF)