Re: [Lurk] Cryptoanalysis of KeyLess SSL

[Daniel Kahn Gillmor <[e-mail]>]

On Fri 2017-04-28 15:40:31 +0300, Dmitry Belyavsky wrote:

> http://epubs.surrey.ac.uk/813643/1/mainKeyless.pdf

thanks for the link, Dmitry!  And thanks to the authors of the paper for
documenting these gaps in the keyless protocol.

I note that the authors of the paper include the following remarks:

    To fully protect clients’ privacy, we believe that clients should be
    made aware of proxying, so they can decide whether they want a
    faster but less secure connection to a CDN or a slower but more
    secure connection directly to the origin server.

It's not clear to me that such a change would actually provide better
protection of client privacy.  In particular, such an option could be
misused by operators of malicious networks or other would-be MiTM
attackers to force themselves into the channel that would otherwise be
opaque to them.

I hope that proposals like the one above will give thoughtful
consideration to the user experience for common clients.  For example,
what would such a notification look like in a web browser?  What would
be the common experience of the browser user?  What would the user's
likely behavior be?  would such a situation really "fully protect
clients' privacy" or would it provide yet another lever of control that
the network operator can exercise over the endpoints?

   --dkg