Re: [TLS] [OPSAWG] CALL FOR ADOPTION: draft-reddy-opsawg-mud-tls

Nick Harper <> Wed, 16 September 2020 20:08 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 197953A0DE3 for <>; Wed, 16 Sep 2020 13:08:59 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -17.6
X-Spam-Status: No, score=-17.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5] autolearn=unavailable autolearn_force=no
Authentication-Results: (amavisd-new); dkim=pass (2048-bit key)
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id nBrKWWB18RHD for <>; Wed, 16 Sep 2020 13:08:56 -0700 (PDT)
Received: from ( [IPv6:2607:f8b0:4864:20::c32]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by (Postfix) with ESMTPS id ABA663A0E18 for <>; Wed, 16 Sep 2020 13:08:56 -0700 (PDT)
Received: by with SMTP id t3so7123ook.8 for <>; Wed, 16 Sep 2020 13:08:56 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=EQV4c/sy3N9yt0xxXqUlppuGlu4IzjI+b9axznxCTxw=; b=r+Q3+aZVQ+UGvv2+H/Kiqbnh0aJdxGPQ9ljUwu+PoC9ALqnGu76C2vdbqx/odfPORo gw/TdFMEJ3S/SjElV62bChzcEWJS7sHz6vq6O1AhOGRyAi7PRYRwYjhaski5qbS6/zO5 sP9qzCRKcIItkPbwcWAbBqrWg0pVhQAtfOjWhwHuo5KPH4RLoywH1W7Eai6GJ3WYEIf6 DYiR2gadjUmGVIppLTNv1jMSF6yX0i4AwKJwy0vQ2KJ4IeipkYn4XrluFH7hoYqdGzHF gtIvZX9HBPXYGDtRf2YmP0yG1bjQp8Dlh2eTUPqn4amO++rBsurGgVZlYp07CUOoxGdV Qaow==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=EQV4c/sy3N9yt0xxXqUlppuGlu4IzjI+b9axznxCTxw=; b=Yp30AJXZRKXM2mMd4lC2mfJZpYboXbHJvaPEUUvxqA1gXvk5B1Nn+EraJYxWSrNmIL se2Zm32gygBcLry+JDi1iAlMWxySfaNwWk+CZaUyjOI3qJzIYIddXNFDnOSY82V/JH4B FWZQv/xnH2OCZSaIHILIFgc9xmeeo+2ztBh9Sqj6IhBJeXsPIT+axZ2a42EpWzSpNawO tx3r/44bNjUgvPOSovoErKpZMwl7j5wH77Y3lEYMG9+Qh7FlDY9NI8xNMNcU/mbwjqi7 NSolqAFfO1KpdLVwTVe23DvP64b+wrOh8+U0gKMag3sR2zBXTn76hZnYGFNH6uM0sp7U glqQ==
X-Gm-Message-State: AOAM530L0bP1PbtdKgT/HdrOJryGDMZYnQwraZS1PutDRMsMe6VAyQzM rkCvxXuu0kksZMypJ6qw7yeRsZJkb8MdDYY88db+Ag==
X-Google-Smtp-Source: ABdhPJzMGAT+X+Sx61zVQCihTp3hS7ChGINi65w/F5Ag7NWwBF6qRWqhv5wZIs2jUw6ajWksmg1YdHPhZE8OSWHHd8k=
X-Received: by 2002:a4a:e689:: with SMTP id u9mr19075771oot.52.1600286935664; Wed, 16 Sep 2020 13:08:55 -0700 (PDT)
MIME-Version: 1.0
References: <> <> <> <> <> <> <> <> <> <> <> <> <> <> <> <>
In-Reply-To: <>
From: Nick Harper <>
Date: Wed, 16 Sep 2020 13:08:44 -0700
Message-ID: <>
To: tirumal reddy <>
Cc: Watson Ladd <>, Eliot Lear <>, opsawg <>, "<>" <>
Content-Type: multipart/alternative; boundary="000000000000573a7105af73d6f3"
Archived-At: <>
Subject: Re: [TLS] [OPSAWG] CALL FOR ADOPTION: draft-reddy-opsawg-mud-tls
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Wed, 16 Sep 2020 20:08:59 -0000

On Wed, Sep 16, 2020 at 12:24 AM tirumal reddy <> wrote:

> Hi Nick,
> Please see inline
> On Wed, 16 Sep 2020 at 06:00, Nick Harper <> wrote:
>> I agree with EKR, Ben Schwartz, and Watson Ladd's concerns on this draft.
>> The grease_extension parameter shouldn't exist, and there should be no
>> special handling for GREASE values. GREASE doesn't need to be mentioned in
>> this draft, except to say that a client may send values (cipher suites,
>> extensions, named groups, signature algorithms, versions, key exchange
>> modes, ALPN identifiers, etc.) that are unknown to the middlebox and that
>> the middlebox MUST NOT reject connections with values unknown to the
>> middlebox.
> The grease_extension parameter in the YANG model is a "boolean" type to
> indicate whether the GREASE values are offered by the client or not.  The
> MUD YANG model does not convey the GREASE values.
This is still problematic.

Unknown values MUST be ignored; GREASE is a mechanism used by endpoints to
check that their peers correctly ignore unknown values (instead of closing
the connection). If a device special-cases GREASE values when processing
TLS messages, that device has completely missed the purpose of GREASE and
is likely to cause interoperability failures when in the future it sees a
TLS message that contains a new extension/cipher suite/etc. that isn't a
GREASE value.

The IETF should not be encouraging devices to special-case GREASE values. I
can see no use of the grease_extension parameter in the YANG model that
does not involve special-casing GREASE values. Hence it needs to be removed.