IETF Logo Mail Archive

Re: [TLS] Update on TLS 1.3 Middlebox Issues

Yoav Nir <ynir.ietf@gmail.com> Sat, 07 October 2017 18:38 UTC

Return-Path: <ynir.ietf@gmail.com>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6F82B1321A2 for <tls@ietfa.amsl.com>; Sat, 7 Oct 2017 11:38:03 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.699
X-Spam-Level:
X-Spam-Status: No, score=-2.699 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5Aw5crQA-Qtg for <tls@ietfa.amsl.com>; Sat, 7 Oct 2017 11:38:01 -0700 (PDT)
Received: from mail-wm0-x235.google.com (mail-wm0-x235.google.com [IPv6:2a00:1450:400c:c09::235]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 67414134B1F for <tls@ietf.org>; Sat, 7 Oct 2017 11:37:40 -0700 (PDT)
Received: by mail-wm0-x235.google.com with SMTP id u138so14374648wmu.4 for <tls@ietf.org>; Sat, 07 Oct 2017 11:37:40 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=bCM72/NQzakRimCPfVqna9qpb6VsY+fCkhvqJPhQPrM=; b=cXyyQTjAoulkFHm9kO2pxlLoiLiavvTvy5GMeN1b5Lb3J/xuQV/SjW9Ctv5phS3itX 2F4/C/fSQy6dhwf3jUWXV9FKVSF3IggKBPODaQcRKqILFGo13fP04rJ/+veJuWm61S/8 ADMt/Gml9VF3wykz/wC/nqGCAQ747aEmQsUKgaTjGTwQP+KiQi+MUkTy6R6txrRO0UUa O2dT+GRKPJW1EikeW1TMoOLE2qlpyIUix6yOliOgFii8H9uSplB3Fv4/uN7bXf5ri17V BjFWzihZJMsizBZp3AdBI2gLwP9OwJE43M228/YM0w3/+Zx1xo+Jrx2nP9wqGSwUmzA2 EjkA==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=bCM72/NQzakRimCPfVqna9qpb6VsY+fCkhvqJPhQPrM=; b=XOt1k2f3Uy371Vh9WPmM3Ludwri/jeg8hSk4Z55fbU9iG7FjkXqA3Md+OzdGXRgGHZ 5Nyv1wwRVky6ToJe9ytloHY4/6jhcvaBBzYbT1FjHZSbAFMDSftZXc+1NDGYj52vB6xQ 2aIHXMmuq7Kjhi+fBgES5FJ4EbcpSV3Y+Noks2uJik48SC92ulPUN9JHM6JpZrBxM1M3 nOgU+pGaKTMotlc8l6OCgmWij+WcdubXNBTHtqy3rBZf550q0IC8GPQWOAA7SBhASRie E5o07lGROKiaNFlVNDR8YZW5bk5UF6g4lUx417fIRFixz6Ao3LDOCLKL1IFGNZX3aX/Z sshQ==
X-Gm-Message-State: AMCzsaViGN6TLP6KsCRqPEYLsxm5fUtDqrIUIFFd09qv5AMYtY2Z0lFc xbc11/UGXW+tVjSSz8qoXdM=
X-Google-Smtp-Source: AOwi7QChTpVWqFQ1SrE7YmsZO2rZHVVB4Od88uGK8wUJYEdVmgryoT1M9ze0uOYBJw86+BvUk0svUA==
X-Received: by 10.80.173.130 with SMTP id a2mr7678963edd.234.1507401458915; Sat, 07 Oct 2017 11:37:38 -0700 (PDT)
Received: from [192.168.1.18] ([46.120.57.147]) by smtp.gmail.com with ESMTPSA id x14sm5782309edd.10.2017.10.07.11.37.36 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Sat, 07 Oct 2017 11:37:37 -0700 (PDT)
From: Yoav Nir <ynir.ietf@gmail.com>
Message-Id: <7412F908-CF35-4239-8F16-A8F30F3F5ABF@gmail.com>
Content-Type: multipart/signed; boundary="Apple-Mail=_8A33CCBA-A95F-4F83-8AD3-435040128DC6"; protocol="application/pgp-signature"; micalg="pgp-sha512"
Mime-Version: 1.0 (Mac OS X Mail 10.3 \(3273\))
Date: Sat, 07 Oct 2017 21:37:35 +0300
In-Reply-To: <CAOjisRx9rwtbwBOTB+PegrKim2Q3bDmwbZi6KAu0aFMEaYSxRw@mail.gmail.com>
Cc: Rich Salz <rsalz@akamai.com>, "tls@ietf.org" <tls@ietf.org>
To: Nick Sullivan <nicholas.sullivan@gmail.com>
References: <CABcZeBMoW8B78C5UmLqAim4X=jQ8jVRYTP-L7RVnU3AScdFvFw@mail.gmail.com> <EAD84CE1-41A9-40FE-B882-18F077FFD691@akamai.com> <17791E16-1E12-4E8E-A098-31E961C2B2CB@gmail.com> <CAOjisRx9rwtbwBOTB+PegrKim2Q3bDmwbZi6KAu0aFMEaYSxRw@mail.gmail.com>
X-Mailer: Apple Mail (2.3273)
Archived-At: <https://mailarchive.ietf.org/arch/msg/tls/Epmv3CRrDKaSIyWEn82uNxBff-g>
Subject: Re: [TLS] Update on TLS 1.3 Middlebox Issues
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sat, 07 Oct 2017 18:38:03 -0000

> On 7 Oct 2017, at 17:17, Nick Sullivan <nicholas.sullivan@gmail.com> wrote:
> 
> Yoav,
> 
> Let me make a correction to your scenario:. Instead of:
> "You’ll need it for Chrome to work with Google."
> it's:
> "You’ll need it for Chrome to work with Google, Facebook, and most of the 10% of Alexa top million sites that are using Cloudflare.”

What part of “not making any configuration changes until the second week of January” is not clear to you?

Seriously, I’ve had this conversation with administrators.

Because if they go to their bosses, they get asked if they can guarantee that the update will cause no outage. Of course they can’t.

Then they get asked if Edge has the same problem. Let’s assume the answer is yes.

Then they get asked if they can turn off TLS 1.3 in Edge using GPO (or whatever the remote configuration of Microsoft Windows is called these days). In all likelihood, the answer is yes.

Problem sovled, no?

But, they’ll protest, more than half our employees use Chrome.

So tell them not to use Chrome, says the manager.

Because for the manager the decision to update the middlebox is all risk with no rewards.

Yoav

v2.23.0 | Report a Bug | By Email