Re: [TLS] Publication of draft-rhrd-tls-tls13-visibility-00

[Ion Larranaga Azcue <[e-mail]>]

Even if YOUR objective is to passively observe, you have to admit that this mechanism allows OTHER PEOPLE using it to modify the encrypted data, and we should always consider the worst-case scenario.

In fact, my opinion a couple of weeks ago was that we had to find some way to provide visibility for TLS 1.3, but after reading other people's comments on this thread, I think there are lots of solutions to provide visibility of the encrypted data within internal networks. And if the transition requires work and money... Well, security always does.

I side with the people that think we should close this topic and move on (I am even wondering if it was a good idea to send this mail and thus fuel the discussion). I'm eager to see a final specification of TLS 1.3 and I'm currently frustrated with being unable to see the light at the end of the tunnel while we are just going round and round the same discussion...

> -----Mensaje original-----
> De: TLS [mailto:[e-mail]] En nombre de Ackermann, Michael
> Enviado el: martes, 24 de octubre de 2017 1:31
> Para: Benjamin Kaduk <[e-mail]>; Tony Arcieri
> <[e-mail]>; Adam Caudill <[e-mail]>
> CC: [e-mail]
> Asunto: Re: [TLS] Publication of draft-rhrd-tls-tls13-visibility-00
> 
> NO
> The objective is to be passively observe, out of band and not to be a MitM or
> modify/inject text.    Just as we all do today.
> 
> -----Original Message-----
> From: Benjamin Kaduk [mailto:[e-mail]]
> Sent: Monday, October 23, 2017 6:33 PM
> To: Ackermann, Michael <[e-mail]>; Tony Arcieri
> <[e-mail]>; Adam Caudill <[e-mail]>
> Cc: [e-mail]
> Subject: Re: [TLS] Publication of draft-rhrd-tls-tls13-visibility-00
> 
> On 10/23/2017 05:09 PM, Ackermann, Michael wrote:
> > No one I am aware of is pushing for a MitM capability to address this.
> > In fact it was one of the alternative solutions for which many
> > implementation issues were cited at the Prague meeting and on this
> > list.    But I would like to ask,  what is the solution that your
> > company and others that you reference,  have solved this problem by
> > implementing?
> 
> Is not draft-rhrd-tls-tls13-visibility a MitM, in that the holder of the
> SSWrapDH1 private key has the cryptographic capability to inject traffic and
> modify plaintext for the affected connections?
> 
> -Ben
> 
> 
> The information contained in this communication is highly confidential and is
> intended solely for the use of the individual(s) to whom this communication
> is directed. If you are not the intended recipient, you are hereby notified
> that any viewing, copying, disclosure or distribution of this information is
> prohibited. Please notify the sender, by electronic mail or telephone, of any
> unintended receipt and delete the original message without making any
> copies.
> 
>  Blue Cross Blue Shield of Michigan and Blue Care Network of Michigan are
> nonprofit corporations and independent licensees of the Blue Cross and Blue
> Shield Association.
> _______________________________________________
> TLS mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/tls