Re: [Patient] [EXT] Re: Slides from the PATIENT meeting in Singapore

[Brian Witten <[e-mail]>]

Thank you Paul for the clarification, particularly on the Note Well!


I'm rusty at this since my last IETF was nearly 20 years ago.


In light of your clarification I won't be distributing more detailed notes in case any of the comments were meant for the moment not for eternity.


Re the URL, will do.  Probably next week if not sooner.


On "why is anything more needed," one of the risks is the "malicious CDN" concern framed in Boneh's Stickler paper, and I can walk through the other limits of current middlebox/proxy approaches as well, but I'm happy to focus first on the ask from Stephen, unless you prefer otherwise.


Thanks Again Either Way!!


Cheers,

Brian



________________________________
From: PATIENT <[e-mail]> on behalf of Paul Wouters <[e-mail]>
Sent: Wednesday, November 15, 2017 7:41:37 PM
To: Brian Witten
Cc: [e-mail]
Subject: [EXT] Re: [Patient] Slides from the PATIENT meeting in Singapore

On Thu, 16 Nov 2017, Brian Witten wrote:

> I'll also very shortly post the slides to this list as promised.

A URL would be better, we can share more easilly (as the archive will
likely mangle the attachment or create a very strange link for it)

> Unless anyone objects on this list, we're working on a more detailed set of notes, Chatham house rules

You can privately do what you want, but Chatham house rules is not
compatible with the IETF Note Well, so anything on this list should
not fall under those rules (and temporarilly working under different
rules for a subset of people seems a bit odd to me). So I am confused
about the "we".

> (a) Helps each endpoint control which parties and network devices are empowered to decrypt traffic to help protect them,
> (b) Helps each endpoint see when one of those parties or devices modifies content coming from the other endpoint, such as removing attacks, and see that with a cryptographic audit trail of who changed what where when and why, such as removing attacks,
> (c) And does all of the above without breaking or weakening any of the cryptography or cryptographic protocols in any way, including not breaking or changing TLS.

I still do not see why I cannot selectively use either a SOCKS proxy or
regular proxy, over regular TLS, to the middleware box / protection
service, on a per-domain basis. That is, you have not convinced me there
is any need for a protocol change. Without a clear need, the exitsing
protocols should not be further complicated.

Paul

_______________________________________________
PATIENT mailing list
[e-mail]
https://clicktime.symantec.com/a/1/7-NZRAvvKnLiRMsQn_pvOJLF807sbWToQe7lFzwCgt4=?d=eexAo6dIX-LOqBzrZPtp3kWS2Y4tkAUQuu0Yt0YntK2V5TnEaRSePWV3hU7KkNbhxO1MwNRnpkyKWYobHNq-bixHBef1KMwY1VN4gm8FbqLT_18q642X6zQhzW3iIwqB8VJZtGFLYeWCbUvfs2yUdnRmUP0hdv3SxIOBRwZAEQgKQJbx5zGYlklLU0Hiai9ChCq9mfsY_rHnoygD8VpcTbOIkmyYiXXAvq9F0I1CPKGp3OAhHytTwN3fkWr9hMiXIt5BFjpNNtQoLjxDxUB5WgxaHat5EX8oAV9EqWQKkMi7ZqlGjcZtULdgCG0_WAPAolWlsAd5zrCNMD5NTROlrLlaZgBsvwZpvUQojIDgTF6w8xg-AnMGg-GeSCXlIqPNq2Pe5cRo3jm6rsJ12W4ymP97N6mbvgFk&u=https%3A%2F%2Fwww.ietf.org%2Fmailman%2Flistinfo%2Fpatient