Re: [TLS] Industry Concerns about TLS 1.3

Sean Turner <sean@sn3rd.com> Wed, 12 October 2016 00:24 UTC

Return-Path: <sean@sn3rd.com>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8479C1295C6 for <tls@ietfa.amsl.com>; Tue, 11 Oct 2016 17:24:56 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.701
X-Spam-Level:
X-Spam-Status: No, score=-2.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=sn3rd.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fF-I5X_5bTwP for <tls@ietfa.amsl.com>; Tue, 11 Oct 2016 17:24:54 -0700 (PDT)
Received: from mail-qk0-x22b.google.com (mail-qk0-x22b.google.com [IPv6:2607:f8b0:400d:c09::22b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E5F8D1293E1 for <tls@ietf.org>; Tue, 11 Oct 2016 17:24:53 -0700 (PDT)
Received: by mail-qk0-x22b.google.com with SMTP id n189so12019312qke.0 for <tls@ietf.org>; Tue, 11 Oct 2016 17:24:53 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sn3rd.com; s=google; h=mime-version:subject:from:in-reply-to:date :content-transfer-encoding:message-id:references:to; bh=3jP2rcUn2BWLuAD9cHFinLTjYATyzswRNVzblXRqOGg=; b=heAQI7cTNLRBPg+Yq17rOcuqIym+MmeTrkta+QwxOuyWIVs8LvEujkYtHueUZW/m1f WxtHv7vVJcd+37tV/Joo75575ti5JpApbPCyBKS4MF2yFfYjRLhvZgItn6ub5/+18+CX wHSW2EG7KxIa/tddBooPUDOMAx6AS5sr8NPTY=
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date :content-transfer-encoding:message-id:references:to; bh=3jP2rcUn2BWLuAD9cHFinLTjYATyzswRNVzblXRqOGg=; b=RcZsErKxjn27YAKm8mREL91yKLFBo33OsW0TlcG5uY4vGGkrEbMN9vEKViepKZ+bv0 mZflpElpig5ELrjpNVTx8ezwv1UxvnYMl0p7fz9gxQDNXGTm2m/IByeuHb1SRdtj2Vew 8+wcz4ev+a8XhnypXw6bEVnNjb97VOik56ssvrTMqhy7IPzypmrtbjgq53a3a7v6nheJ W2Fd6Splzr3G4JqezYL8Qn+AfOdP4btJ2ZYON8uDzq2F7mUhpVpKSYvewkBCLr567GoQ /tIXbB1EFjONfbM+5vHD+yAnEzd12Gxbe+uKtAbX3UKPRRjsSRJJmMdOPjFWsUWlPCIy YoVg==
X-Gm-Message-State: AA6/9Rm1FWoe/KI3YWr+BrkdCdgfbQvhf2w5VREVKFIlRolYnlEAF2bn+wiHZ6BCPFgxPg==
X-Received: by 10.55.65.22 with SMTP id o22mr5610866qka.136.1476231892775; Tue, 11 Oct 2016 17:24:52 -0700 (PDT)
Received: from [172.16.0.112] ([96.231.229.241]) by smtp.gmail.com with ESMTPSA id l6sm1959842qkd.41.2016.10.11.17.24.50 for <tls@ietf.org> (version=TLS1 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Tue, 11 Oct 2016 17:24:51 -0700 (PDT)
Content-Type: text/plain; charset="utf-8"
Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\))
From: Sean Turner <sean@sn3rd.com>
In-Reply-To: <DM5PR11MB14199E0093EB60D453E632C8F4C40@DM5PR11MB1419.namprd11.prod.outlook.com>
Date: Tue, 11 Oct 2016 20:24:49 -0400
Content-Transfer-Encoding: quoted-printable
Message-Id: <AF828B03-4BF3-48AC-BB34-F2C7A50AF4D8@sn3rd.com>
References: <DM5PR11MB1419B782D2BEF0E0A35E420DF4C90@DM5PR11MB1419.namprd11.prod.outlook.com> <87fuoa64p4.fsf@mid.deneb.enyo.de> <DM5PR11MB14199E0093EB60D453E632C8F4C40@DM5PR11MB1419.namprd11.prod.outlook.com>
To: "tls@ietf.org" <tls@ietf.org>
X-Mailer: Apple Mail (2.3124)
Archived-At: <https://mailarchive.ietf.org/arch/msg/tls/3YOneH3ZYDNY5C8kws-7O-UQjvk>
Subject: Re: [TLS] Industry Concerns about TLS 1.3
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.17
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 12 Oct 2016 00:24:56 -0000

As one of the WG chairs, it looks like it’s time to bring to a close whether or not we’ll be re-introducing static RSA key exchange.

One digression before that though: I think there is a realization in the IAB, IESG, and many parts of the IETF that significant operational/management issues exist with encryption; the MaRNEW workshop [0][1][2], some related drafts [3][4], and the PLUS/ACCORD BOFs proposals are just some examples that reflect this.

On dropping static RSA key exchange: The DH-only key exchange proposal had a very lengthy and robust discussion.  PFS was definitely a driver [5], but the simplifying effect of removing static RSA key exchange was another one that should not be forgotten; less options, less code, (hopefully) less coding errors.  It is probably also worth pointing out that the "remove RSA key exchange" shoe has been dropping since 2003: “RSAES-OAEP is recommended for new applications; RSAES-PKCS1-v1_5 is included only for compatibility with existing applications, and is not recommended for new applications” [6].

On the one hand, I am sympathetic to concerns about impacts resulting from protocol changes.  On the other hand, the cycle of new protocol version followed by product updates is not really that out of the ordinary; this cycle is disliked by those with budgets but normal nonetheless.  Also, there appears to be a couple of different solutions that would allow an enterprise to do what it wants.  I’m not seeing anything that would alter the consensus that we reached earlier to drop static RSA key exchange from TLS 1.3.

spt

[0] https://www.iab.org/activities/workshops/marnew/
[1] https://datatracker.ietf.org/doc/draft-nrooney-marnew-report/
[2] https://www.ietf.org/proceedings/94/slides/slides-94-saag-1.pdf
[3] https://www.ietf.org/archive/id/draft-mm-wg-effect-encrypt-03.txt
[4] https://datatracker.ietf.org/doc/draft-smith-encrypted-traffic-management/
[5] https://datatracker.ietf.org/doc/rfc7525/
[6] https://datatracker.ietf.org/doc/rfc3447/

> On Oct 05, 2016, at 15:37, BITS Security <BITSSecurity@fsroundtable.org> wrote:
> 
> Florian--Anecdotally, I have heard Microsoft and F5 did code upgrades a few years back that moved Diffie Hellman to the top cipher suite priorities which broke security and fraud monitoring, APM reporting, and sniffer troubleshooting for a financial services client and at least one other organization in a different industry.  
> 
> The solution, at the time, was to put the PFS options (choices we will no longer in 1.3) at the bottom of the priority list.  I don't know how much of this was communicated back to the vendors at the time.  
> 
> In retrospect, this could have been seen as the canary in the coalmine... but here we are now at least.  
> 
> - Andrew 
> 
> 
> -----Original Message-----
> From: Florian Weimer [mailto:fw@deneb.enyo.de] 
> Sent: Wednesday, October 5, 2016 2:17 PM
> To: BITS Security <BITSSecurity@fsroundtable.org>
> Cc: tls@ietf.org
> Subject: Re: [TLS] Industry Concerns about TLS 1.3
> 
> * BITS Security:
> 
>> Deprecation of the RSA key exchange in TLS 1.3 will cause significant 
>> problems for financial institutions, almost all of whom are running 
>> TLS internally and have significant, security-critical investments in 
>> out-of-band TLS decryption.
>> 
>> Like many enterprises, financial institutions depend upon the ability 
>> to decrypt TLS traffic to implement data loss protection, intrusion 
>> detection and prevention, malware detection, packet capture and 
>> analysis, and DDoS mitigation.
> 
> We should have already seen this with changing defaults in crypto libraries as part of security updates.  That should have broken passive monitoring infrastructure, too.
> 
> Maybe some of the vendors can shed some light on this problem and tell us if they ever have received pushback for rolling out ECDHE-by-default.  (I know that some products have few capabilities for centralized policy management, which is why defaults matter a lot
> there.)
> 
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls