Re: [TLS] Publication of draft-rhrd-tls-tls13-visibility-00

[Kathleen Moriarty <[e-mail]>]

On Tue, Oct 24, 2017 at 4:24 PM, Ted Lemon <[e-mail]> wrote:
> On Oct 24, 2017, at 4:21 PM, David A. Cooper <[e-mail]> wrote:
>
> I'm not suggesting that cash strapped schools would use one of these
> devices. I'm simply saying that such a solution would be simpler and far
> more effective than trying to use draft-rhrd-tls-tls13-visibility to snoop
> on outgoing traffic.
>
>
> Again, if that were true, then it would also be true that these devices
> would nicely solve the problem that draft-rhrd-tls-tls13-visibility solves.

These are two different problems and although you could use a proxy
solution inside a datacenter, it doesn't scale or make sense.  IMO,
David countered Yoav's clever scenario very well.

Now, the proponents are asking for alternatives to consider and a
serious look at their proposal.  Can we look at this request
constructively and provide a cohesive set of alternate solutions?

IPsec [1] might be possible, but requires a change in tooling for
intercepting traffic.  In hosted environments, it also could change
who is managing the encryption (TCP/application vs. IP layer).
I also received a comment that you could also tie in use of IPv6 and
label sessions with the IPsec approach and that makes sense.

What about the experimental drafts in TCPInc?  [2]
This provides opportunistically encrypted TCP, so you could MiTM it.

Are there other alternate solutions that have been discussed or should
be?  Maybe it would be helpful to list them out for comparison and
evaluation by those interested - not on list as that's off-topic.


[1] https://www.rsa.com/en-us/blog/2017-08/tls-security-and-data-center-monitoring-searching-for-a-path-forward
[2] https://datatracker.ietf.org/doc/draft-ietf-tcpinc-tcpeno/?include_text=1

Thanks,
Kathleen

>
>
> _______________________________________________
> TLS mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/tls
>



-- 

Best regards,
Kathleen