Re: [pkix] How do we differentiate authentic servers from proxies performing TLS interception?

Peter Bowen <pzbowen@gmail.com> Tue, 24 November 2015 20:40 UTC

Return-Path: <pzbowen@gmail.com>
X-Original-To: pkix@ietfa.amsl.com
Delivered-To: pkix@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5855F1A89A7 for <pkix@ietfa.amsl.com>; Tue, 24 Nov 2015 12:40:56 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2
X-Spam-Level:
X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Fb4ETgZYeOQN for <pkix@ietfa.amsl.com>; Tue, 24 Nov 2015 12:40:55 -0800 (PST)
Received: from mail-pa0-x229.google.com (mail-pa0-x229.google.com [IPv6:2607:f8b0:400e:c03::229]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0D8A61A89A1 for <pkix@ietf.org>; Tue, 24 Nov 2015 12:40:55 -0800 (PST)
Received: by padhx2 with SMTP id hx2so32825719pad.1 for <pkix@ietf.org>; Tue, 24 Nov 2015 12:40:54 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=vpkkhcwV/8NX0sKiF1FEoMDNQOauL3CZakbZ/PxPI0E=; b=ObGkTV4kE5u5vNee4j1SEU4JKBW/1tIC6qemMmUhfS95jw06Fb5LqXKHwEVGvSeZRk vbluetHM7zR/Z3RD5EIqz4MNN6codeQLfdlqv2VoNffOTL6msUCF6yn+C6/AEE/GVjo2 16FNxwozy4fXSWcZ55ts6JhSkYsUom+qU8MYgJnYTtKq9mxhorVjLDi288PwmfeoRkE9 bXreneIIzIPezBrAe0nf+YkXLQ/Uam1cGnKRDdP1879cVlrq3liCcD8T94qmLTVDkPYW 4pyjjLbfzad5xFDd8zKWoafzy+/nTZgx3nTB/HIH8DoogXHnigLO0GfyerHVU0RC0t5L FQoA==
MIME-Version: 1.0
X-Received: by 10.98.14.207 with SMTP id 76mr25854030pfo.86.1448397654643; Tue, 24 Nov 2015 12:40:54 -0800 (PST)
Received: by 10.66.142.193 with HTTP; Tue, 24 Nov 2015 12:40:54 -0800 (PST)
In-Reply-To: <CAH8yC8my4kPh4gCw1PxKNzeQiatBsc2bqi+Y3Tf_4dxtUMatfw@mail.gmail.com>
References: <BY2PR09MB1094EA71ADDC83440AE82F2AE120@BY2PR09MB109.namprd09.prod.outlook.com> <20151112163810.E8F351A368@ld9781.wdf.sap.corp> <BY2PR09MB109B9B70BC1746B516CB335AE120@BY2PR09MB109.namprd09.prod.outlook.com> <CAH8yC8n41uA-Aj3pLKRHgjGu1P6smwG-r-dA595rXHMjhAZC_A@mail.gmail.com> <BY2PR09MB10945A7D32E11E8C5E74750AE120@BY2PR09MB109.namprd09.prod.outlook.com> <201511152227.tAFMRTjH000463@d01av04.pok.ibm.com> <6ADE63A8-8B81-48F5-BF37-F91B734935C3@mitre.org> <CAH8yC8=XK12R=ox=Uw2jYyk_z0ukB4nbpeVbiyb-ZGOKMSskFQ@mail.gmail.com> <5E42AC43-684C-4CCE-900C-1CD20E88267F@mitre.org> <CAH8yC8mk7MnFa34507-z_ERZFba675bQ+VR-wrreC8w2O=-LHg@mail.gmail.com> <690F0024-1027-49DE-809F-DC89E68B3DD9@mitre.org> <CAH8yC8my4kPh4gCw1PxKNzeQiatBsc2bqi+Y3Tf_4dxtUMatfw@mail.gmail.com>
Date: Tue, 24 Nov 2015 12:40:54 -0800
Message-ID: <CAK6vND9Z2jmc_b71Bit-=4yO5n7_cX4V+7UGM_JsYbbkgWi33w@mail.gmail.com>
From: Peter Bowen <pzbowen@gmail.com>
To: noloader@gmail.com
Content-Type: text/plain; charset=UTF-8
Archived-At: <http://mailarchive.ietf.org/arch/msg/pkix/58Y6hck74kt3sq2O-PvPtdGAsUU>
Cc: PKIX <pkix@ietf.org>
Subject: Re: [pkix] How do we differentiate authentic servers from proxies performing TLS interception?
X-BeenThere: pkix@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: PKIX Working Group <pkix.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/pkix>, <mailto:pkix-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/pkix/>
List-Post: <mailto:pkix@ietf.org>
List-Help: <mailto:pkix-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/pkix>, <mailto:pkix-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 24 Nov 2015 20:40:56 -0000

On Tue, Nov 24, 2015 at 10:04 AM, Jeffrey Walton <noloader@gmail.com> wrote:
>> No, the least disruptive option is to leverage existing standards without modification to implement both the signal and the verification.  Frex., adding a DANE record check to TLS server authN verification.
>>
>
> OK, thanks Tim.
>
> So let me wrap this up... What is the IETF and/or PKIX going to
> provide us with to discern between authentic servers and
> proxied/intercepted connections now that Public Key Pinning with
> Overrides is here?
>
> What do I tell my developers?

I'm a little lost.  What are you trying to achieve?  Assuming your
developers are writing a client app, I see several scenarios:

1) You have a client application relying on a shared trust store.  The
proxy is configured to issue certificates signed by something in the
trust store.  In this case validation works as normal.

2) Validation passes, but there are additional post-validation
constraints validation info (e.g PKP).  The constraints fail. In this
case, you check the trust store to see if the CA signing the cert is a
"system" CA or a "user" CA.  If user, ignore PKP.

3) You have a client app that has its own trust store.  The proxy's
certificate is not signed by a CA in your list.  Validation fails.

4) The proxy is signing with an unknown certificate.  Validation fails.

In none of the scenarios does it help to have a flag for 'this is a
proxy'.   The only place it would help is if you wanted to only allow
overrides where the User CA explicitly indicated it was trying to
override.  However I can't imagine when the CA would not set this.

Thanks,
Peter