Re: [TLS] Publication of draft-rhrd-tls-tls13-visibility-00

Tony Arcieri <bascule@gmail.com> Fri, 20 October 2017 22:02 UTC

Return-Path: <bascule@gmail.com>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9F8E2132CE7 for <tls@ietfa.amsl.com>; Fri, 20 Oct 2017 15:02:35 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.998
X-Spam-Level:
X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id u_MH6nmDMc_9 for <tls@ietfa.amsl.com>; Fri, 20 Oct 2017 15:02:34 -0700 (PDT)
Received: from mail-qt0-x235.google.com (mail-qt0-x235.google.com [IPv6:2607:f8b0:400d:c0d::235]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 640FB12ECEC for <tls@ietf.org>; Fri, 20 Oct 2017 15:02:34 -0700 (PDT)
Received: by mail-qt0-x235.google.com with SMTP id z50so20192014qtj.4 for <tls@ietf.org>; Fri, 20 Oct 2017 15:02:34 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=dqaVCHAsGKA1MxlrtCdCXFvN8we5908I37NdOxe2yrI=; b=jw7mx47Skv7zn1ieeoPIAqkNaoIdB+JMVqTMRq2iN+mqt1DnNXN7yXVLDtdMY5eDYD 60/ddKQngZsza6+xxiybulmmiZuauq7uaq7m782QGMm5QSdHChmbnjzPDcUzA/1rcoYs P3AOWnakFnVz+IlFACX2f76BfREzpFfsDSezgGpxJjUBd/Nj4bHm1o3arV+rPypp5/4L sndH03pCZozgMj/PrwT/Jri9PpV56DPqbuCIuQc0l4Zzzo2+IPJWxtRnWwGPEGcjTE6E TNsXAmLn1iXz0523ui8SXViL6yebSBG64lgPTKobL4pEnqgThAY8LjFFCXAjWi4S4lpL fOsA==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=dqaVCHAsGKA1MxlrtCdCXFvN8we5908I37NdOxe2yrI=; b=dJDn/oxOytHxqmYZlkWBUTeczbn5zubhIw0NFEq9BA2eIIgq/fyC3Jl1YadZW2e/tv kn2UfC42L527nn/FDJNu9vL6DHLrgQagnCdEhPVTu1CwgIhIGj0tkJHzg5enUl01oJB2 cn+ZNUbzS56iqO5ol1uTJY3dInDsOAyWnKMuHofx55E/fqt28hdiOyBmiFbDE0Om3SIB 2E05tdbrgfEzzl6Clza1TTb4o9jwfvqv5bAnGOBUF2jTsBnse68bF//4l9SZmuGOyGVp tiO4cG70heDwhkIfqg7yEvwXg+LQhkkjnwqjqEhkJeaQdSMTG9PebxpBsAVe/se7vR4c G8PA==
X-Gm-Message-State: AMCzsaV95bYw9ycDzufJQJQdV2hgOE4GBc9b5op1SHM8QKOVk+0IL3eQ BTCs22z3txi5XbcMcnDnXZQCzjPlyj9q6WsAIVU=
X-Google-Smtp-Source: ABhQp+Slcyexs46WGDzovkeOojOiRwrofRj0Pmotti37JV1V3ItDZ3ys2qXKbsjCgIDAug1QZTmO4MJgDiObndqtbIQ=
X-Received: by 10.200.17.1 with SMTP id c1mr9042621qtj.252.1508536953455; Fri, 20 Oct 2017 15:02:33 -0700 (PDT)
MIME-Version: 1.0
Received: by 10.200.56.11 with HTTP; Fri, 20 Oct 2017 15:02:12 -0700 (PDT)
In-Reply-To: <20171020182725.7gim6dg3mrl67cuh@LK-Perkele-VII>
References: <56687FEC-508F-4457-83CC-7C379387240D@akamai.com> <c1c0d010293c449481f8751c3b85d6ae@venafi.com> <4167392E-07FB-46D5-9FBC-4773881BFD2C@akamai.com> <3d5a0c1aab3e4ceb85ff631f8365618f@venafi.com> <E84889BB-08B3-4A3A-AE3A-687874B16440@akamai.com> <CAPBBiVQvtQbD4j3ofpCmG63MEyRWF15VL90NOTjeNqUOiyo6xg@mail.gmail.com> <9013424B-4F6D-4185-9BFD-EC454FF80F22@akamai.com> <CY4PR14MB1368CBA562220D9A3604F0FFD7430@CY4PR14MB1368.namprd14.prod.outlook.com> <2741e833-c0d1-33ca-0ad3-b71122220bc5@cs.tcd.ie> <CY4PR14MB136835A3306DEEFCA89D3C2DD7430@CY4PR14MB1368.namprd14.prod.outlook.com> <20171020182725.7gim6dg3mrl67cuh@LK-Perkele-VII>
From: Tony Arcieri <bascule@gmail.com>
Date: Fri, 20 Oct 2017 15:02:12 -0700
Message-ID: <CAHOTMVJXiQqMGPfRy=z2=3D60L08BURrOxSAgGdH8_TCO6Hr8g@mail.gmail.com>
To: Ilari Liusvaara <ilariliusvaara@welho.com>
Cc: "Ackermann, Michael" <MAckermann@bcbsm.com>, "tls@ietf.org" <tls@ietf.org>
Content-Type: multipart/alternative; boundary="089e082651683dcb21055c01a160"
Archived-At: <https://mailarchive.ietf.org/arch/msg/tls/EbBVBUZkMhnwVkf0RBecyaE3utY>
Subject: Re: [TLS] Publication of draft-rhrd-tls-tls13-visibility-00
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 20 Oct 2017 22:02:36 -0000

On Fri, Oct 20, 2017 at 11:27 AM, Ilari Liusvaara <ilariliusvaara@welho.com>;
wrote:

> TLS 1.2 will very probably remain viable until quantum computers come
> and demolish its security, unfortunately.


As someone who has spent a lot of time working on compliance for payments
systems, I have an open question to the "visibility" advocates:

Can you provide a *specific citation* as to where you will be *required* to
use TLS 1.3 any time in, say, the next decade?

This is absolutely not the case for PCI-DSS.

To my knowledge any requirement of this nature simply doesn't exist. I
could be wrong but... citation needed.

If there is no pressing reason for legacy systems which are dependent on
"visibility"/self-MitM capability because their observability story is so
poor and they can't use endpoint agents to solve the same problems, what is
the case for trying to add MitM mechanisms now?

The answer is simple: stay on TLS 1.2 (or earlier) until you can improve
your observability story, or *specific* requirements which *mandate* use of
TLS 1.3 actually manifest. From previous experience: such mandates will not
be a fire drill, but will be years in the making, and repeatedly delayed
due to "industry" requirements / shortcomings.

-- 
Tony Arcieri