Re: [OPSEC] [TLS] Call For Adoption: draft-wang-opsec-tls-proxy-bp

[Martin Thomson <[e-mail]>]

On Mon, Jul 20, 2020, at 03:34, Ron Bonica wrote:
> This email begins a Call For Adoption on draft-wang-opsec-tls-proxy-bp 
> <https://datatracker.ietf.org/doc/draft-wang-opsec-tls-proxy-bp/>.

I think that others have said enough about the wisdom of adoption of the approach.  I agree with them, but recognize the right to disagree.

Even if we were to accept that it is a good idea to document best practices for TLS proxying, this document is not currently a good basis for that work.  The introduction is a little deceptive, in that it says that it is about proxying, but there are numerous places in the draft that talk about selective proxying or some amount of forwarding and inspection.  Those practices would require design work.  From what I can infer from the draft, it often assumes the same sort of bad designs that are specifically identified elsewhere as having bad characteristics.

As it is, the draft is not consistent in terms of its approach and scope.  If the goal is to describe pure proxying (a TLS server and a TLS client that intermediate), then it needs a good edit.  If the goal is to describe selective proxying or selective forwarding and modification of TLS messages, then that is a much bigger task.  What are often stated in the draft as requirements around this points are in fact assumptions.  And many of them bad, as others have stated.

--- More detail follows

Intermediaries if this nature are added to effect some sort of centralized control.  This seems to be the primary motivation here also.  If we accept that this is happening, it is important to note the operational effects of that.  Not just on those who have this desire, but on all of those affected.

There is some text about the effect this might have on the ability of clients or servers to introduce new features in Section 4.8.  This is nowhere near sufficient.  By breaking the connection the number of stack layers that are exposed to potential interference, the consequences are not limited to TLS.

Creating negative externalities contributes to TLS interception being despised.  If the intent is to help, then this doesn't go nearly far enough in describing the secondary effects a proxy might cause.


Probably the worst problem is rooted in Section 5.1.  The introduction establishes this as being about proxying, but there are several places that talk about not-proxying sometimes.

Selective non-proxying opens the document up to a whole new set of problems that arise from poor designs for deciding not to proxy.  There is not nearly enough detail here to address this problem properly.  A "good" design for selective TLS proxying does not seem to be the basis of the recommendations.  I'll give a few examples of problems.

>From the Section 4.8 again:

> the TLS proxy MUST conduct proper TLS protocol checks to avoid false identification of TLS handshakes, while taking special care not to contribute to protocol ossification.  

This practice has been directly responsible for more ossification than intermediation, no matter what qualification exists.  

If per-destination not-proxying is required, the proxy can connect to a server, determine that the server is on a non-proxy list, and then complete the handshake with the client (with a caveat regarding ECH here).  I can guess why this doesn't happen (it's expensive and see also Section 5.4), but that doesn't excuse the practice.

The following text from Section 5.3 is deeply problematic:

   A decryption policy decision MAY be made based on the server
   certificate or other trustworthy parameters.  To verify possession of
   private keys that are associated with a particular server
   certificate, the proxy SHOULD complete an out-of-band TLS handshake
   with the same TLS server IP address and TCP port as targeted by the
   TLS client.

It is possible that the authors misunderstand how TLS works, but this check won't work.  Not only because TLS 1.3 encrypts information, but because this is only necessary if the proxy forwards a ClientHello from the client to the server.  At that point, it is too late and the damage has been done (see Andrei's review).


There are a bunch of places where pure proxying - as described in the introduction - is not assumed.  This leads to the same problems already cited.  For instance, in Section 4.2:

> The proxy MAY remove cipher suites from a client-initiated Client Hello message, add new cipher suites, and re-order them in the proxy-initiated Client Hello message.