[DNSOP] Re: [EXTERNAL] New Version Notification for draft-tjjk-cared-00.txt

[Paul Vixie <[e-mail]>]

-- 
P Vixie

On Tuesday, July 23, 2024 12:52:28 PM PDT Paul Wouters wrote:
> On Jul 23, 2024, at 12:09, Paul Vixie <paul=[e-mail]> 
wrote:
> > Making TLS 1.2 available as a fallback is vital. Many secure private edge
> > networks will never allow TLS 1.3 because of ECH.
> 
> You can do TLS 1.3 without ECH ?

if an endpoint wants TLS 1.3 with ECH, there's no way to negotiate them down 
to TLS 1.3 without ECH. there is a way to negotiate them down to TLS 1.2.

> Making  a weaker version of TLS mandatory would be unwise, unless it’s to
> give more time for migration away from it.

migration for military, government, and many corporate networks can't happen. 
for reasons of law, regulation, or policy, they must see the client hello 
before they can decide whether to block the flow. "just secure your devices" 
can't work due to the way the supply chain works. the only alternative will be 
to block outbound entirely and force all traffic through a non-intercepting 
proxy.

ietf knew this, but RFC 8890 forbade us to consider it. i was a dissenter. the 
fact that you refer to TLS 1.2 as "weaker" may indicate a preference that we 
mandate a technology that often _cannot_ be used even those the alternative 
("effective mandate") will be a technology (explicit proxy) which is in fact 
weaker than TLS 1.2. we should not argue from talking points.

don't put it in terms of migration. just recommend that fallback be allowed. 
50 years from now, smarter people than us can think of a better way forward. 
as things are today, secure private edge networks including military, 
government, and many commercial networks, will not allow TLS 1.3 to be used.

paul