Re: [TLS] draft-green-tls-static-dh-in-tls13-01

"Ackermann, Michael" <MAckermann@bcbsm.com> Sat, 15 July 2017 18:16 UTC

Return-Path: <mackermann@bcbsm.com>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3567012F5DB for <tls@ietfa.amsl.com>; Sat, 15 Jul 2017 11:16:18 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -4.09
X-Spam-Level:
X-Spam-Status: No, score=-4.09 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, T_DKIM_INVALID=0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=fail (1024-bit key) reason="fail (body has been altered)" header.d=bcbsm.onmicrosoft.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Dk-tMBikz7ty for <tls@ietfa.amsl.com>; Sat, 15 Jul 2017 11:16:16 -0700 (PDT)
Received: from mx.z120.zixworks.com (bcbsm.zixworks.com [199.30.235.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 986DA126C7A for <tls@ietf.org>; Sat, 15 Jul 2017 11:16:14 -0700 (PDT)
Received: from 127.0.0.1 (ZixVPM [127.0.0.1]) by Outbound.z120.zixworks.com (Proprietary) with SMTP id 7CBEE1C18E6 for <tls@ietf.org>; Sat, 15 Jul 2017 13:16:13 -0500 (CDT)
Received: from imsva1.bcbsm.com (unknown [12.107.172.80]) by mx.z120.zixworks.com (Proprietary) with SMTP id 86C9E1C176C; Sat, 15 Jul 2017 13:16:12 -0500 (CDT)
Received: from imsva1.bcbsm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 506679206F; Sat, 15 Jul 2017 14:16:12 -0400 (EDT)
Received: from imsva1.bcbsm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 10DB99206A; Sat, 15 Jul 2017 14:16:12 -0400 (EDT)
Received: from NAM03-DM3-obe.outbound.protection.outlook.com (unknown [207.46.163.22]) by imsva1.bcbsm.com (Postfix) with ESMTPS; Sat, 15 Jul 2017 14:16:11 -0400 (EDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=bcbsm.onmicrosoft.com; s=selector1-bcbsm-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=nQH9kYlOwm648GvmtF0WMG2Tqx5Cx5SUNgQLyT4YQgo=; b=TWfaLofbaVqT9LN/kr5+psEDL+Fb/1mP9vBxko7MsEcfbfx23Dm6Y8Lmv91abLpqWZGKBB094XEDJ1Q5QvFsHokkXAOlzOA6sWQyO6gHHWOQ0bcpTnDjBgTbmsII0yoZNUvwJTbxNwSXbwVVtw+N1d9dx8DUAspquHS3omJtHEQ=
Received: from BN6PR14MB1361.namprd14.prod.outlook.com (10.172.149.135) by BN6PR14MB1362.namprd14.prod.outlook.com (10.172.149.136) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1261.13; Sat, 15 Jul 2017 18:16:10 +0000
Received: from BN6PR14MB1361.namprd14.prod.outlook.com ([10.172.149.135]) by BN6PR14MB1361.namprd14.prod.outlook.com ([10.172.149.135]) with mapi id 15.01.1261.020; Sat, 15 Jul 2017 18:16:10 +0000
From: "Ackermann, Michael" <MAckermann@bcbsm.com>
To: "Dobbins, Roland" <rdobbins@arbor.net>
CC: Ted Lemon <mellon@fugue.com>, IETF TLS <tls@ietf.org>, Matthew Green <matthewdgreen@gmail.com>
Thread-Topic: [TLS] draft-green-tls-static-dh-in-tls13-01
Thread-Index: AQHS9u8RCuLDt7dBiEuHKxJZjnlNtqJIVJcAgAA7lACAAB2RAIAABXEAgAABDQCAABZYAIALriyAgAAVWACAAAFKgIAAAg+AgAADOACAAHw4YIAAKnSAgAADSxA=
Date: Sat, 15 Jul 2017 18:16:10 +0000
Message-ID: <BN6PR14MB13612896CAA0EA9AB34BA390D7A20@BN6PR14MB1361.namprd14.prod.outlook.com>
References: <CAPCANN-xgf3auqy+pFfL6VO5GpEsCCHYkROAwiB1u=8a4yj+Fg@mail.gmail.com> <CAL02cgRJeauV9NQ2OrGK1ocQtg-M2tbWm2+5HUc4-Wc8KC3vxQ@mail.gmail.com> <71E07F32-230F-447C-B85B-9B3B4146D386@vigilsec.com> <39bad3e9-2e17-30f6-48a7-a035d449dce7@cs.tcd.ie> <CAJU8_nXBFkpncFDy4QFnd6hFpC7oOZn-F1-EuBC2vk3Y6QKq3A@mail.gmail.com> <f0554055-cdd3-a78c-8ab1-e84f9b624fda@cs.tcd.ie> <A0BEC2E3-8CF5-433D-BA77-E8474A2C922A@vigilsec.com> <87k23arzac.fsf@fifthhorseman.net> <D37DF005-4C6E-4EA8-9D9D-6016A04DF69E@arbor.net> <CAPt1N1nVhCQBnHd_MCm79e7c1gO6CY6vZG_rZSNePPvmmU_Bow@mail.gmail.com> <44AB7CB8-13C1-44A0-9EC4-B6824272A247@arbor.net> <CAPt1N1=rvtssKXCnsNmr1vy4ejb6YDUxO2kDcgh-ZMh5WGjfWg@mail.gmail.com>, <CY4PR14MB136850FD3287DEAD0CD44C78D7A20@CY4PR14MB1368.namprd14.prod.outlook.com> <46888EEF-750B-46CF-BA77-1827DD6D3607@arbor.net>
In-Reply-To: <46888EEF-750B-46CF-BA77-1827DD6D3607@arbor.net>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
authentication-results: arbor.net; dkim=none (message not signed) header.d=none;arbor.net; dmarc=none action=none header.from=bcbsm.com;
x-originating-ip: [165.225.0.71]
x-ms-publictraffictype: Email
x-microsoft-exchange-diagnostics: 1; BN6PR14MB1362; 20:YpYCK1Ggnx6bTVpNOo6cAb8y4eukQ17J3HoNnYRMdHpfnJsZymUhbGjQmMT0VNmrQ3X6Np6dtL0cIDQhl/9nKXZ6Ip4kZZl5giIjR6dbalTooLJhFFgwvuOkCmF5IDYftiegQCvAxjQ1dxV8PL/DmQf0TQTK7mmrb7t1ZVDS1Rg=
x-ms-office365-filtering-correlation-id: 710865df-0a04-4a7c-31f0-08d4cbad91fb
x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(300000500095)(300135000095)(300000501095)(300135300095)(22001)(300000502095)(300135100095)(2017030254075)(300000503095)(300135400095)(2017052603031)(201703131423075)(201703031133081)(300000504095)(300135200095)(300000505095)(300135600095)(300000506095)(300135500095); SRVR:BN6PR14MB1362;
x-ms-traffictypediagnostic: BN6PR14MB1362:
x-exchange-antispam-report-test: UriScan:(151999592597050)(26388249023172)(236129657087228)(148574349560750)(21748063052155)(86572411397741);
x-microsoft-antispam-prvs: <BN6PR14MB1362F6C1132EA2010F0FEC2FD7A20@BN6PR14MB1362.namprd14.prod.outlook.com>
x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(100000700101)(100105000095)(100000701101)(100105300095)(100000702101)(100105100095)(6040450)(601004)(2401047)(8121501046)(5005006)(2017060910075)(93006095)(93001095)(10201501046)(100000703101)(100105400095)(3002001)(6041248)(201703131423075)(201702281528075)(201703061421075)(201703061406153)(20161123555025)(20161123562025)(20161123564025)(20161123560025)(20161123558100)(6072148)(100000704101)(100105200095)(100000705101)(100105500095); SRVR:BN6PR14MB1362; BCL:0; PCL:0; RULEID:(100000800101)(100110000095)(100000801101)(100110300095)(100000802101)(100110100095)(100000803101)(100110400095)(100000804101)(100110200095)(100000805101)(100110500095); SRVR:BN6PR14MB1362;
x-forefront-prvs: 0369E8196C
x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(39450400003)(39400400002)(39410400002)(39830400002)(377454003)(24454002)(14454004)(6436002)(53546010)(2900100001)(2906002)(229853002)(99286003)(54906002)(77096006)(7696004)(55016002)(478600001)(6506006)(93886004)(80792005)(6306002)(54896002)(9686003)(236005)(19609705001)(25786009)(8936002)(53936002)(8676002)(66066001)(230783001)(72206003)(33656002)(39060400002)(3660700001)(3280700002)(790700001)(4326008)(102836003)(3846002)(6116002)(74316002)(189998001)(81166006)(6246003)(7736002)(54356999)(2950100002)(6916009)(50986999)(76176999)(38730400002)(110136004)(5660300001)(86362001); DIR:OUT; SFP:1102; SCL:1; SRVR:BN6PR14MB1362; H:BN6PR14MB1361.namprd14.prod.outlook.com; FPR:; SPF:None; MLV:ovrnspm; PTR:InfoNoRecords; LANG:en;
spamdiagnosticoutput: 1:99
spamdiagnosticmetadata: NSPM
Content-Type: multipart/alternative; boundary="_000_BN6PR14MB13612896CAA0EA9AB34BA390D7A20BN6PR14MB1361namp_"
MIME-Version: 1.0
X-OriginatorOrg: bcbsm.com
X-MS-Exchange-CrossTenant-originalarrivaltime: 15 Jul 2017 18:16:10.3459 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 6f56d3fa-5682-4261-b169-bc0d615da17c
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN6PR14MB1362
X-TM-AS-GCONF: 00
X-VPM-HOST: vmvpm01.z120.zixworks.com
X-VPM-GROUP-ID: fba002b9-3626-4e49-ad4d-027cda1cd9ce
X-VPM-MSG-ID: d9508ab4-b7a3-4d62-b65f-390f1881f9b6
X-VPM-ENC-REGIME: Plaintext
X-VPM-IS-HYBRID: 0
Archived-At: <https://mailarchive.ietf.org/arch/msg/tls/C-0xFeWYfSgBERfRcgvffIYYQhY>
Subject: Re: [TLS] draft-green-tls-static-dh-in-tls13-01
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sat, 15 Jul 2017 18:16:18 -0000

YES!
I tried to say in my message that collecting traces on thousands,  or hundreds of thousands of hosts,  is just not practical or possible.   Not to mention the administrative domain barriers to this.



From: Dobbins, Roland [mailto:rdobbins@arbor.net]
Sent: Saturday, July 15, 2017 2:03 PM
To: Ackermann, Michael <MAckermann@bcbsm.com>
Cc: Ted Lemon <mellon@fugue.com>; IETF TLS <tls@ietf.org>; Matthew Green <matthewdgreen@gmail.com>
Subject: Re: [TLS] draft-green-tls-static-dh-in-tls13-01



On Jul 15, 2017, at 22:36, Ackermann, Michael <MAckermann@bcbsm.com<mailto:MAckermann@bcbsm.com>> wrote:
That being the unencrypted stream is available to the endpoints

Even where it is eventually available, they don't have the horsepower to capture & forward.

-----------------------------------
Roland Dobbins <rdobbins@arbor.net<mailto:rdobbins@arbor.net>>




The information contained in this communication is highly confidential and is intended solely for the use of the individual(s) to whom this communication is directed. If you are not the intended recipient, you are hereby notified that any viewing, copying, disclosure or distribution of this information is prohibited. Please notify the sender, by electronic mail or telephone, of any unintended receipt and delete the original message without making any copies.
 
 Blue Cross Blue Shield of Michigan and Blue Care Network of Michigan are nonprofit corporations and independent licensees of the Blue Cross and Blue Shield Association.