Re: [OPSEC] [TLS] Call For Adoption: draft-wang-opsec-tls-proxy-bp

["Eric Wang (ejwang)" <[e-mail]>]

Thank you for the detailed comments.

The scope of the document is limited to proxy at the TLS layer.  Explicitly out of the scope is inspection of the proxied record data.   Will clean up derivations from this scope.

It was the intention to cover selective proxying however, because that is a practical requirement for an actual deployment.  The intention was to discuss the TLS layer attributes (e.g. SNI, Server Cert) that could be used as input for the decision.  The document also stated the requirement to gracefully remove the proxy from the session when needed (and possible).  But the criteria for selective proxying decision, being compliance, privacy, risk level,... are out of the scope.  The decision making often falls under the larger “policy” domain and is controlled at system level outside of the proxy.  It also left out discussion on the detailed mechanism which was deemed as implementation specific.

In any case, the proxy has to conduct selective proxying in a safe, non-disruptive manner. This may require more design work as you pointed out.  The document could describe possible mechanisms so that an acceptable practice could be discussed.  We are open to other ways to shape it.

More inline...


On Jul 28, 2020, at 12:25 AM, Martin Thomson <[e-mail]<mailto:[e-mail]>> wrote:

On Mon, Jul 20, 2020, at 03:34, Ron Bonica wrote:
This email begins a Call For Adoption on draft-wang-opsec-tls-proxy-bp
<https://datatracker.ietf.org/doc/draft-wang-opsec-tls-proxy-bp/>.

I think that others have said enough about the wisdom of adoption of the approach.  I agree with them, but recognize the right to disagree.

Even if we were to accept that it is a good idea to document best practices for TLS proxying, this document is not currently a good basis for that work.  The introduction is a little deceptive, in that it says that it is about proxying, but there are numerous places in the draft that talk about selective proxying or some amount of forwarding and inspection.  Those practices would require design work.  From what I can infer from the draft, it often assumes the same sort of bad designs that are specifically identified elsewhere as having bad characteristics.

As it is, the draft is not consistent in terms of its approach and scope.  If the goal is to describe pure proxying (a TLS server and a TLS client that intermediate), then it needs a good edit.  If the goal is to describe selective proxying or selective forwarding and modification of TLS messages, then that is a much bigger task.  What are often stated in the draft as requirements around this points are in fact assumptions.  And many of them bad, as others have stated.

--- More detail follows

Intermediaries if this nature are added to effect some sort of centralized control.  This seems to be the primary motivation here also.  If we accept that this is happening, it is important to note the operational effects of that.  Not just on those who have this desire, but on all of those affected.

There is some text about the effect this might have on the ability of clients or servers to introduce new features in Section 4.8.  This is nowhere near sufficient.  By breaking the connection the number of stack layers that are exposed to potential interference, the consequences are not limited to TLS.

Creating negative externalities contributes to TLS interception being despised.  If the intent is to help, then this doesn't go nearly far enough in describing the secondary effects a proxy might cause.


Indeed it was driven by sort of “centralized control” from the network (including OS stack). The industry has moved to a hybrid model with a combination of endpoint (client, server), application, and network based solutions. Endpoint/App based solution plays an increasingly important role and likely not requiring an intermediary. Meanwhile, network based solution including intermediary continues to be deployed for various reasons. We could add more analysis related a TLS proxy though a full blown discussion would be out of the scope.

From another perspective, the trend calls for more collaboration between the solutions and elements, especially between client apps and the network.  In some sense, this document also surfaces some issues and gaps. A proxy can only operate within the scope specified by the current standards.



Probably the worst problem is rooted in Section 5.1.  The introduction establishes this as being about proxying, but there are several places that talk about not-proxying sometimes.

Selective non-proxying opens the document up to a whole new set of problems that arise from poor designs for deciding not to proxy.  There is not nearly enough detail here to address this problem properly.  A "good" design for selective TLS proxying does not seem to be the basis of the recommendations.  I'll give a few examples of problems.

From the Section 4.8 again:

the TLS proxy MUST conduct proper TLS protocol checks to avoid false identification of TLS handshakes, while taking special care not to contribute to protocol ossification.

This practice has been directly responsible for more ossification than intermediation, no matter what qualification exists.

If per-destination not-proxying is required, the proxy can connect to a server, determine that the server is on a non-proxy list, and then complete the handshake with the client (with a caveat regarding ECH here).  I can guess why this doesn't happen (it's expensive and see also Section 5.4), but that doesn't excuse the practice.

The following text from Section 5.3 is deeply problematic:

  A decryption policy decision MAY be made based on the server
  certificate or other trustworthy parameters.  To verify possession of
  private keys that are associated with a particular server
  certificate, the proxy SHOULD complete an out-of-band TLS handshake
  with the same TLS server IP address and TCP port as targeted by the
  TLS client.

It is possible that the authors misunderstand how TLS works, but this check won't work.  Not only because TLS 1.3 encrypts information, but because this is only necessary if the proxy forwards a ClientHello from the client to the server.  At that point, it is too late and the damage has been done (see Andrei's review).


Unless I misunderstood it, the document is suggesting the same as you listed.  Basically, the proxy makes a separate connection to the server as a client (“out-of-band” wrt to the originating client-server connection), retrieves the server’s certificate from the proxy-server handshake, and determines whether the server is on a non-proxying list or not.  If on the list, the proxy forwards the originating client CH as is to the server, and steps aways from the originating client-server handshake.

There are additional considerations in this approach (latency etc.). The document intentionally left out the details to implementations, but could also cover them if needed.




There are a bunch of places where pure proxying - as described in the introduction - is not assumed.  This leads to the same problems already cited.  For instance, in Section 4.2:

The proxy MAY remove cipher suites from a client-initiated Client Hello message, add new cipher suites, and re-order them in the proxy-initiated Client Hello message.

Will clean up those texts based on this and other discussions.

Best,
-Eric




_______________________________________________
OPSEC mailing list
[e-mail]<mailto:[e-mail]>
https://www.ietf.org/mailman/listinfo/opsec