Re: [TLS] Rethink TLS 1.3

[Nico Williams <[e-mail]>]

On Fri, Nov 28, 2014 at 08:45:00AM +0000, Peter Gutmann wrote:
> Nico Williams <[e-mail]> writes:
> >Yes, it's quaint.  It's also as best we can do, unless...
> 
> If that's the best we can do then it's better to have no threat model at all
> than something that misleading, because all it's doing is giving a false sense
> of security.  It doesn't even begin to capture semantics like:
> 
>   Alice will perform arbitrary scripted operations at the request of Mallory,
>   directed against herself and/or Bob.
> 
> a standard feature of every web browser out there.  As a model against which
> to measure the security of an application or implementation, it's only
> slightly less useless than nothing at all.

That's changing the subject.  Where have I argued that the web security
mode is great or even permitted by the Internet threat model.

The web security model is... unlike anything produced by the IETF, and
it wasn't produced by the IETF.  It's an alien as far as we're concerned
here.  You'd be hard-pressed to find fans of it at the IETF.  And it
would require torturing logic to say that the Internet threat model
allows the web security model.  From where we stand we can't really go
fix the web security model either, much though we'd like, but we can
make TLS 1.3 not fail spectacularly (BEAST and others) in a web context.

If you want a holistic approach, well, I agree, but that means getting
people in the same room who usually don't do that, and it means getting
people to agree to things that they aren't inclined to.  Let's!  (Any
ideas as to how to?)

Nico
--