Re: [Secdispatch] Oblivious HTTP charter draft

[Martin Thomson <[e-mail]>]

Thanks for the response Michael,

On Fri, Mar 19, 2021, at 00:09, Michael Richardson wrote:
> It seems weird that TLS is not mentioned :-)

It doesn't mention IP either.  Maybe we can just take TLS as read.
 
>     > The working group will define a format for any encryption keys that are
>     > needed. The working group will not describe how encryption keys are
>     > obtained.
> 
> My understanding is that we don't need new infrastructure, because HTTPS
> provides what we need.  So I think this text is unnecessary.

Maybe the draft isn't clear enough on this point.  For reasons described in draft-wood-key-consistency, key acquisition is not that simple.  The draft does mention HTTPS, but carefully avoids specifying its use.  I think that this bit of scope-limiting is critical.
 
> I think that there may be push in the WG to provide some extension to allow
> the proxy to snoop on, but not modify, the traffic.
> It may be worth coding this into the charter as out of scope.

I thought that "Encryption ensures that the proxy is unable to read requests or responses." was pretty clear on this point.  FWIW, I think that the IETF has been pretty good at resisting attempts to remove essential protections in our protocols.  I don't see a need to codify that in a charter; it would say more about our lack of confidence than it would affect outcomes.