Re: [OPSAWG] [TLS] CALL FOR ADOPTION: draft-reddy-opsawg-mud-tls

[Ben Schwartz <[e-mail]>]

On Tue, Sep 15, 2020 at 6:45 AM tirumal reddy <[e-mail]> wrote:

> Thanks Ben and Eliot for the feedback. Please see inline
>
> On Tue, 15 Sep 2020 at 14:51, Eliot Lear <[e-mail]> wrote:
>
...

> What I do see as a showstopper would be if, as is written and you rightly
>> observe, a new rev of a YANG model is required to introduce the TLS
>> extension, so that part would need to be described in a more flexible
>> manner (e.g, an IANA registration or similar).  I’d suggest the authors
>> consider that.
>>
>
> Agreed, the YANG model relies on IANA for TLS parameters values including
> extension type values. Even if a f/w does not support a new extension, it
> can still identify whether the new extension is included in the MUD
> profile. If the extension is not included in the MUD profile, presence of
> unauthorized software is detected.
>
> We will update the draft to make it more clear.
>

My concern is not with "new extensions" per se.  The hidden assumption here
is that "extensions" are the only way TLS can evolve.  In fact, future TLS
versions are not constrained to evolve in any particular way.  For example,
future versions can introduce entirely new messages in the handshake, or
remove messages that are currently visible in the handshake.  QUIC is
arguably just an extreme version of this observation.

Even within the realm of ClientHello extensions, there is significant
inflexibility here.  For example, consider the handling of GREASE
extensions.  GREASE uses a variety of reserved extension codepoints,
specifically to make sure that no entity is attempting to restrict use of
unrecognized extensions.  This proposal therefore has to add a flag
declaring whether the client uses GREASE, because otherwise the set of
extensions is dynamic, and the number of potential codepoints is
impractically large.  Any change to the way GREASE selects and rotates
extension codepoints would therefore require a revision of this YANG model
first.  There has also been discussion of adding GREASE-type behavior to
the "supported_versions" extension; that would similarly require a revised
YANG model here.


> -Tiru
>
>
>> Eliot
>>
>>
>>
>>