Re: [TLS] TLS Proxy Server Extension

After watching the back and forth on TLS proxies, and the ever increasing complexity of proposed bandaids to cover individual vulnerabilities, this is starting to look like rearranging the deck chairs on the Titanic. 

TLS is used by people to insure end to end integrity and privacy, usually, with PKI. Users are protected from intermediate parties if the system architects and TLS management by the controlling application have correctly handled the design of the PKI(e.g. insuring that the CN is in fact the desired name and that the root certificate applicable to the presented certificate are as expected, etc.). 

If you want to proxy, you are delegating trust to another entity and effectively running a tandem pair of TLS sessions. 

IMHO, this is not a protocol issue. It is a systems engineering exercise in trust relationships. 

Most security people I know would agree with me that complexity is the enemy of security. Adding all of these modifications to the protocol only increases the chances of introducing new holes in its protection.

Ken Peirce    

> 
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls
> 