Re: [TLS] TLS Proxy Server Extension

[Matt McCutchen <[e-mail]>]

On Tue, 2011-07-26 at 08:01 -0700, David McGrew wrote:
> I would like to request feedback on a new draft that Philip Gladstone  
> and I put together, which aims to solve some of the security problems  
> that happen when there is a (HTTP) proxy present and TLS is in use.

It doesn't seem that this work is in any way specific to HTTP.

Suggestions:

- If you're going to require support from the client, you might as well
do something to support client authentication on the server-side
connection, e.g., tunnel the PKCS#11 protocol back to the client.

- You could bundle the whole sequence of handshake messages from the
server-side connection in the ProxyInfo and let the client deal with it
rather than muck about with the ConnectionSecurityParameters here.  This
would include any further ProxyInfos without making a special case.

- It would be better design to put the whole certificate acceptance test
(trust anchor validation + server name check) on the client.  Schemes
such as DANE replace the certificate acceptance test as a whole.

- One approach would be to do a real escrowed TLS where the client
negotiates directly with the server but releases the confidentiality key
and optionally also the integrity key to the proxy.  This subsumes all
of the above concerns but doesn't allow the proxy to manipulate the
handshake in any finer way than blocking the connection if it doesn't
like the outcome.

-- 
Matt