Re: [TLS] TLS Proxy Server Extension

[David McGrew <[e-mail]>]

Hi Adam and Yoav,

On Jul 26, 2011, at 2:51 PM, Adam Langley wrote:

> On Tue, Jul 26, 2011 at 5:41 PM, Yoav Nir <[e-mail]> wrote:
>> Really?  I thought Chrome used the operating system TA store. How  
>> can it tell the difference between a trust anchor that was  
>> installed by Microsoft and one that was installed by the user?
>
> Not in any very clean way I'm afraid:
>
> http://src.chromium.org/viewvc/chrome/trunk/src/net/base/x509_certificate_known_roots_win.h?revision=80765&view=markup
>
>> But I know that the EV indication goes away behind a proxy, and  
>> there's no way to make your CA certificate "EV" to the browser.  
>> Dave's proposal allows the green label to come back.
>

I like the succinct way that you put it.

> I've poked BlueCoat at least about this problem in the past and they
> didn't appear to be too exercised by it. It's really the MITM folks
> who need to figure out if this address their needs or not. I simply
> don't know the requirements in this space well enough to know if the
> draft meets them. From my point of view, we keep MITM in the back of
> our minds but otherwise mostly ignore them except to ban certain
> troublesome vendors from time to time.
>

I believe that the approach in the draft meets the broad requirements  
of many MITM devices and services: it doesn't require much new session  
state, or new policy that would need to be coordinated or managed, and  
there is not too much additional computation.  That plus it adds back  
security, which is important in general and is especially important  
for proxy devices that are providing security services.   But I can't  
claim to have broad knowledge of all such devices, so it will be  
useful to hear from others in this space.

David

>
> Cheers
>
> AGL