IETF Logo Mail Archive

Re: [TLS] draft-green-tls-static-dh-in-tls13-01

"Ackermann, Michael" <MAckermann@bcbsm.com> Sat, 15 July 2017 15:46 UTC

Return-Path: <mackermann@bcbsm.com>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B925B12F28B for <tls@ietfa.amsl.com>; Sat, 15 Jul 2017 08:46:20 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -4.091
X-Spam-Level:
X-Spam-Status: No, score=-4.091 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, T_DKIM_INVALID=0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=fail (1024-bit key) reason="fail (body has been altered)" header.d=bcbsm.onmicrosoft.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id owy6z-nJC6I1 for <tls@ietfa.amsl.com>; Sat, 15 Jul 2017 08:46:19 -0700 (PDT)
Received: from mx.z120.zixworks.com (bcbsm.zixworks.com [199.30.235.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 14852126BF0 for <tls@ietf.org>; Sat, 15 Jul 2017 08:46:18 -0700 (PDT)
Received: from 127.0.0.1 (ZixVPM [127.0.0.1]) by Outbound.z120.zixworks.com (Proprietary) with SMTP id 4302E1C190A for <tls@ietf.org>; Sat, 15 Jul 2017 10:46:18 -0500 (CDT)
Received: from imsva1.bcbsm.com (unknown [12.107.172.80]) by mx.z120.zixworks.com (Proprietary) with SMTP id 6F7151C181B; Sat, 15 Jul 2017 10:46:17 -0500 (CDT)
Received: from imsva1.bcbsm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 3ABAB92057; Sat, 15 Jul 2017 11:46:17 -0400 (EDT)
Received: from imsva1.bcbsm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 0E6F092053; Sat, 15 Jul 2017 11:46:16 -0400 (EDT)
Received: from NAM01-SN1-obe.outbound.protection.outlook.com (unknown [207.46.163.119]) by imsva1.bcbsm.com (Postfix) with ESMTPS; Sat, 15 Jul 2017 11:46:16 -0400 (EDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=bcbsm.onmicrosoft.com; s=selector1-bcbsm-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=rX/O4AGdTUoAIlLezES2P6l/JaNHbJmCi0Ow17agGVg=; b=p39zNHqbCCKR++CNYlHJsen4tvqoAB3+RY8Vz7WVbaAS8apgJ5K2VmnebXi/rQcvgTvkfrTUpsxtt8Js01pB4iC4otkmENl10YCQKpVZuQVLZlwLPW0O/GeiSIYV2hnAVJYyQpTfpi5qcLiLcGtL552a5ycZ06q73epKrqg2k2Y=
Received: from CY4PR14MB1368.namprd14.prod.outlook.com (10.172.158.148) by CY4PR14MB1367.namprd14.prod.outlook.com (10.172.158.147) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1240.13; Sat, 15 Jul 2017 15:46:15 +0000
Received: from CY4PR14MB1368.namprd14.prod.outlook.com ([10.172.158.148]) by CY4PR14MB1368.namprd14.prod.outlook.com ([10.172.158.148]) with mapi id 15.01.1240.022; Sat, 15 Jul 2017 15:46:15 +0000
From: "Ackermann, Michael" <MAckermann@bcbsm.com>
To: Daniel Kahn Gillmor <dkg@fifthhorseman.net>, Ilari Liusvaara <ilariliusvaara@welho.com>, "Dobbins, Roland" <rdobbins@arbor.net>
CC: IETF TLS <tls@ietf.org>
Thread-Topic: [TLS] draft-green-tls-static-dh-in-tls13-01
Thread-Index: AQHS9u8RCuLDt7dBiEuHKxJZjnlNtqJIVJcAgAA7lACAAB2RAIAABXEAgAABDQCAABZYAIALriyAgAAW3oCAABLOAIAAKBQAgABKGMA=
Date: Sat, 15 Jul 2017 15:46:14 +0000
Message-ID: <CY4PR14MB1368E4C3C09CC53C33D9DE0ED7A20@CY4PR14MB1368.namprd14.prod.outlook.com>
References: <CAPCANN-xgf3auqy+pFfL6VO5GpEsCCHYkROAwiB1u=8a4yj+Fg@mail.gmail.com> <CAL02cgRJeauV9NQ2OrGK1ocQtg-M2tbWm2+5HUc4-Wc8KC3vxQ@mail.gmail.com> <71E07F32-230F-447C-B85B-9B3B4146D386@vigilsec.com> <39bad3e9-2e17-30f6-48a7-a035d449dce7@cs.tcd.ie> <CAJU8_nXBFkpncFDy4QFnd6hFpC7oOZn-F1-EuBC2vk3Y6QKq3A@mail.gmail.com> <f0554055-cdd3-a78c-8ab1-e84f9b624fda@cs.tcd.ie> <A0BEC2E3-8CF5-433D-BA77-E8474A2C922A@vigilsec.com> <87k23arzac.fsf@fifthhorseman.net> <C4968C13-3229-43C2-B29B-EC9C01D76D06@arbor.net> <20170715085544.y3hozzzpqzrfacd7@LK-Perkele-VII> <87379yrlqp.fsf@fifthhorseman.net>
In-Reply-To: <87379yrlqp.fsf@fifthhorseman.net>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
authentication-results: fifthhorseman.net; dkim=none (message not signed) header.d=none;fifthhorseman.net; dmarc=none action=none header.from=bcbsm.com;
x-originating-ip: [2602:304:ce75:4b0:1414:401b:871e:f658]
x-ms-publictraffictype: Email
x-microsoft-exchange-diagnostics: 1; CY4PR14MB1367; 20:VlzvHm/L4/HmbA62DBmD5hvn+2AZup4xntApC+AYrFU2pGr+8Kik7AtFY7Ec8B+sqGnz/LFSF+Iqo1+iGP4H6m/RVQZbEi0hGn4x0daMSloD68KGZ5ZY/B2/xOWrvfAr7I0Tx4G9hrJksmr2sP3D9ZRDsLejthKFRmUA9XIxZAw=
x-ms-office365-filtering-correlation-id: 1a2d7c86-b593-4071-1c09-08d4cb98a04d
x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(300000500095)(300135000095)(300000501095)(300135300095)(22001)(300000502095)(300135100095)(2017030254075)(300000503095)(300135400095)(2017052603031)(201703131423075)(201703031133081)(201702281549075)(300000504095)(300135200095)(300000505095)(300135600095)(300000506095)(300135500095); SRVR:CY4PR14MB1367;
x-ms-traffictypediagnostic: CY4PR14MB1367:
x-exchange-antispam-report-test: UriScan:(125551606395959)(236129657087228)(192374486261705)(48057245064654);
x-microsoft-antispam-prvs: <CY4PR14MB136755CDD47B6C4C6349E012D7A20@CY4PR14MB1367.namprd14.prod.outlook.com>
x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(100000700101)(100105000095)(100000701101)(100105300095)(100000702101)(100105100095)(6040450)(601004)(2401047)(2017060910075)(5005006)(8121501046)(3002001)(100000703101)(100105400095)(93006095)(93001095)(10201501046)(6041248)(20161123564025)(20161123562025)(20161123560025)(20161123555025)(20161123558100)(201703131423075)(201702281528075)(201703061421075)(201703061406153)(6072148)(100000704101)(100105200095)(100000705101)(100105500095); SRVR:CY4PR14MB1367; BCL:0; PCL:0; RULEID:(100000800101)(100110000095)(100000801101)(100110300095)(100000802101)(100110100095)(100000803101)(100110400095)(100000804101)(100110200095)(100000805101)(100110500095); SRVR:CY4PR14MB1367;
x-forefront-prvs: 0369E8196C
x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(6009001)(39400400002)(39410400002)(39830400002)(39450400003)(24454002)(13464003)(377424004)(377454003)(5660300001)(77096006)(33656002)(3660700001)(3280700002)(6116002)(102836003)(86362001)(189998001)(74316002)(7696004)(4326008)(6506006)(25786009)(230783001)(53936002)(9686003)(55016002)(305945005)(38730400002)(93886004)(6436002)(6246003)(2950100002)(99286003)(7736002)(2906002)(2900100001)(8936002)(8676002)(81166006)(53546010)(478600001)(50986999)(54356999)(14454004)(76176999)(72206003)(80792005)(229853002); DIR:OUT; SFP:1102; SCL:1; SRVR:CY4PR14MB1367; H:CY4PR14MB1368.namprd14.prod.outlook.com; FPR:; SPF:None; MLV:sfv; LANG:en;
spamdiagnosticoutput: 1:99
spamdiagnosticmetadata: NSPM
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-OriginatorOrg: bcbsm.com
X-MS-Exchange-CrossTenant-originalarrivaltime: 15 Jul 2017 15:46:14.8770 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 6f56d3fa-5682-4261-b169-bc0d615da17c
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY4PR14MB1367
X-TM-AS-GCONF: 00
X-VPM-HOST: vmvpm01.z120.zixworks.com
X-VPM-GROUP-ID: 1fa7ee1b-abdb-459c-a83a-cbbef801a6e7
X-VPM-MSG-ID: 87e47b48-224c-44c6-a12b-6e78eacd9649
X-VPM-ENC-REGIME: Plaintext
X-VPM-IS-HYBRID: 0
Archived-At: <https://mailarchive.ietf.org/arch/msg/tls/GJRWHZZtaTgtAk41tCsmxHHj5Q4>
Subject: Re: [TLS] draft-green-tls-static-dh-in-tls13-01
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sat, 15 Jul 2017 15:46:21 -0000

Most of us have Key Vaults and related management systems that are so (OVER in my opinion) secure, that this has never been a problem for us (in reality ---- NOT in theory or conversation).   

-----Original Message-----
From: TLS [mailto:tls-bounces@ietf.org] On Behalf Of Daniel Kahn Gillmor
Sent: Saturday, July 15, 2017 7:19 AM
To: Ilari Liusvaara <ilariliusvaara@welho.com>; Dobbins, Roland <rdobbins@arbor.net>
Cc: IETF TLS <tls@ietf.org>
Subject: Re: [TLS] draft-green-tls-static-dh-in-tls13-01

On Sat 2017-07-15 11:55:44 +0300, Ilari Liusvaara wrote:
> Oh, and like any backdoor, this backdoor too has variety of security 
> problems. And your adversaries would absolutely love to be able to 
> exploit _you_ using these problems, as that would make their lives 
> much easier.

I'd like to hear from the people who are doing full-take network capture within their datacenters about how they protect the security of the internal decryption systems.  It certainly sounds like a tempting target for any adversary interested in datacenter operations.

           --dkg


The information contained in this communication is highly confidential and is intended solely for the use of the individual(s) to whom this communication is directed. If you are not the intended recipient, you are hereby notified that any viewing, copying, disclosure or distribution of this information is prohibited. Please notify the sender, by electronic mail or telephone, of any unintended receipt and delete the original message without making any copies.
 
 Blue Cross Blue Shield of Michigan and Blue Care Network of Michigan are nonprofit corporations and independent licensees of the Blue Cross and Blue Shield Association.

v2.23.0 | Report a Bug | By Email