IETF Logo Mail Archive

Re: [TLS] TLS Proxy Server Extension

Adam Langley <agl@google.com> Tue, 26 July 2011 21:52 UTC

Return-Path: <agl@google.com>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 121E15E800F for <tls@ietfa.amsl.com>; Tue, 26 Jul 2011 14:52:01 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -105.902
X-Spam-Level:
X-Spam-Status: No, score=-105.902 tagged_above=-999 required=5 tests=[AWL=0.075, BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id kzHFAaQdNJvQ for <tls@ietfa.amsl.com>; Tue, 26 Jul 2011 14:52:00 -0700 (PDT)
Received: from smtp-out.google.com (smtp-out.google.com [74.125.121.67]) by ietfa.amsl.com (Postfix) with ESMTP id 339AC5E8008 for <tls@ietf.org>; Tue, 26 Jul 2011 14:52:00 -0700 (PDT)
Received: from kpbe12.cbf.corp.google.com (kpbe12.cbf.corp.google.com [172.25.105.76]) by smtp-out.google.com with ESMTP id p6QLpw66015437 for <tls@ietf.org>; Tue, 26 Jul 2011 14:51:59 -0700
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=google.com; s=beta; t=1311717119; bh=4o7DQRwJf5JlOxnfWrOjF+1c2co=; h=MIME-Version:In-Reply-To:References:Date:Message-ID:Subject:From: To:Cc:Content-Type:Content-Transfer-Encoding; b=Eltn3GsAb9g9n5+jMSUXUXih3YOK3H0Sj2LzduAxGaXHvyG+CB5YWm/wZIANqe5kQ U5eGNxU5m9xTa17YAnRcQ==
DomainKey-Signature: a=rsa-sha1; s=beta; d=google.com; c=nofws; q=dns; h=dkim-signature:mime-version:in-reply-to:references:date: message-id:subject:from:to:cc:content-type: content-transfer-encoding:x-system-of-record; b=ElsF61ESmqYff16+iQ8nMzABS11rWYujg5upPrxOY2h6Dwu7OVlZ7D7O8VwbJRmQU Kzkl/vdsK+t7a6UczH9IA==
Received: from gyc15 (gyc15.prod.google.com [10.243.49.143]) by kpbe12.cbf.corp.google.com with ESMTP id p6QLpvIE006148 (version=TLSv1/SSLv3 cipher=RC4-SHA bits=128 verify=NOT) for <tls@ietf.org>; Tue, 26 Jul 2011 14:51:57 -0700
Received: by gyc15 with SMTP id 15so681823gyc.38 for <tls@ietf.org>; Tue, 26 Jul 2011 14:51:56 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=beta; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type:content-transfer-encoding; bh=72bTU8t5oFgwipyVft2LJSm9kjyhHgInBYcdYRfYatI=; b=t2Pz0JVSAi0RT7Phk1zYFb7reX7gn1AvvvprnxySVFV+xiJPaN9lqsg4tm3SsrIvl0 4DUH1AEFgD7MVMl4cx7g==
MIME-Version: 1.0
Received: by 10.150.254.20 with SMTP id b20mr6407441ybi.91.1311717116816; Tue, 26 Jul 2011 14:51:56 -0700 (PDT)
Received: by 10.151.47.19 with HTTP; Tue, 26 Jul 2011 14:51:56 -0700 (PDT)
In-Reply-To: <FCA03B83-11E6-4AA6-9ACD-42CDAD14FC46@checkpoint.com>
References: <E210EEE3-1855-4513-87E3-C315E611AB5E@cisco.com> <8FEC3C4B-32F9-46AF-A049-BE6FD3C2FE1A@checkpoint.com> <CAL9PXLwXqssrwDM4HytB_eNBT-LFK5fRAOVQ-ehd1XwhH6-8Ag@mail.gmail.com> <FCA03B83-11E6-4AA6-9ACD-42CDAD14FC46@checkpoint.com>
Date: Tue, 26 Jul 2011 17:51:56 -0400
Message-ID: <CAL9PXLyDdeA4FcWGZF3fUxPoJY=1q1QMvJ=y7Q_Oc8Txj4ofvg@mail.gmail.com>
From: Adam Langley <agl@google.com>
To: Yoav Nir <ynir@checkpoint.com>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
X-System-Of-Record: true
Cc: Philip Gladstone <pgladstone@cisco.com>, David McGrew <mcgrew@cisco.com>, "tls@ietf.org" <tls@ietf.org>
Subject: Re: [TLS] TLS Proxy Server Extension
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/tls>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 26 Jul 2011 21:52:01 -0000

On Tue, Jul 26, 2011 at 5:41 PM, Yoav Nir <ynir@checkpoint.com> wrote:
> Really?  I thought Chrome used the operating system TA store. How can it tell the difference between a trust anchor that was installed by Microsoft and one that was installed by the user?

Not in any very clean way I'm afraid:

http://src.chromium.org/viewvc/chrome/trunk/src/net/base/x509_certificate_known_roots_win.h?revision=80765&view=markup

> But I know that the EV indication goes away behind a proxy, and there's no way to make your CA certificate "EV" to the browser. Dave's proposal allows the green label to come back.

I've poked BlueCoat at least about this problem in the past and they
didn't appear to be too exercised by it. It's really the MITM folks
who need to figure out if this address their needs or not. I simply
don't know the requirements in this space well enough to know if the
draft meets them. From my point of view, we keep MITM in the back of
our minds but otherwise mostly ignore them except to ban certain
troublesome vendors from time to time.


Cheers

AGL

v2.23.0 | Report a Bug | By Email