Re: [TLS] I-D Action: draft-ietf-tls-grease-01.txt
Christian Huitema <huitema@huitema.net> Sat, 09 June 2018 01:13 UTC
Return-Path: <huitema@huitema.net>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1])
by ietfa.amsl.com (Postfix) with ESMTP id 73EC0130DCE
for <tls@ietfa.amsl.com>; Fri, 8 Jun 2018 18:13:48 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.599
X-Spam-Level:
X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5
tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7,
SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44])
by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024)
with ESMTP id pYr8kO2Yl5z0 for <tls@ietfa.amsl.com>;
Fri, 8 Jun 2018 18:13:46 -0700 (PDT)
Received: from mx43-out1.antispamcloud.com (mx43-out1.antispamcloud.com
[138.201.61.189])
(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
(No client certificate requested)
by ietfa.amsl.com (Postfix) with ESMTPS id 5F7181277C8
for <tls@ietf.org>; Fri, 8 Jun 2018 18:13:46 -0700 (PDT)
Received: from xsmtp05.mail2web.com ([168.144.250.245])
by mx66.antispamcloud.com with esmtps (TLSv1:AES256-SHA:256)
(Exim 4.89) (envelope-from <huitema@huitema.net>) id 1fRSRr-00081a-VS
for tls@ietf.org; Sat, 09 Jun 2018 03:13:44 +0200
Received: from [10.5.2.52] (helo=xmail12.myhosting.com)
by xsmtp05.mail2web.com with esmtps (TLS-1.0:DHE_RSA_AES_256_CBC_SHA1:32)
(Exim 4.63) (envelope-from <huitema@huitema.net>) id 1fRSRl-0005KZ-6G
for tls@ietf.org; Fri, 08 Jun 2018 21:13:41 -0400
Received: (qmail 26257 invoked from network); 9 Jun 2018 01:13:33 -0000
Received: from unknown (HELO [192.168.0.104])
(Authenticated-user:_huitema@huitema.net@[172.56.42.97])
(envelope-sender <huitema@huitema.net>)
by xmail12.myhosting.com (qmail-ldap-1.03) with ESMTPA
for <tls@ietf.org>; 9 Jun 2018 01:13:33 -0000
To: tls@ietf.org
References: <152830634989.6264.3566629916218895862@ietfa.amsl.com>
<CAF8qwaC+NpLo1c=7KTD02-Wjo5Akp+5GtCF9ZBs8iF=Jtun1Vg@mail.gmail.com>
<20180607210040.GA13834@akamai.com>
<CAF8qwaCUmk9+iQ76VL1EL5S+MufmUk2-SsZ1rH6CgJLsYQC5ZQ@mail.gmail.com>
<163dfb8ceb7.fef8d66b166467.2392907059047091602@nerd.ninja>
<CAF8qwaCQRS00nJWtk3RBob82NbCfuD32uUJpzjgx=-FhxdWNDQ@mail.gmail.com>
From: Christian Huitema <huitema@huitema.net>
Openpgp: preference=signencrypt
Autocrypt: addr=huitema@huitema.net; prefer-encrypt=mutual; keydata=
xsBNBFIRX8gBCAC26usy/Ya38IqaLBSu33vKD6hP5Yw390XsWLaAZTeQR64OJEkoOdXpvcOS
HWfMIlD5s5+oHfLe8jjmErFAXYJ8yytPj1fD2OdSKAe1TccUBiOXT8wdVxSr5d0alExVv/LO
I/vA2aU1TwOkVHKSapD7j8/HZBrqIWRrXUSj2f5n9tY2nJzG9KRzSG0giaJWBfUFiGb4lvsy
IaCaIU0YpfkDDk6PtK5YYzuCeF0B+O7N9LhDu/foUUc4MNq4K3EKDPb2FL1Hrv0XHpkXeMRZ
olpH8SUFUJbmi+zYRuUgcXgMZRmZFL1tu6z9h6gY4/KPyF9aYot6zG28Qk/BFQRtj7V1ABEB
AAHNJ0NocmlzdGlhbiBIdWl0ZW1hIDxodWl0ZW1hQGh1aXRlbWEubmV0PsLAeQQTAQIAIwUC
UhFfyAIbLwcLCQgHAwIBBhUIAgkKCwQWAgMBAh4BAheAAAoJEJNDCbJVyA1yhbYH/1ud6x6m
VqGIp0JcZUfSQO8w+TjugqxCyGNn+w/6Qb5O/xENxNQ4HaMQ5uSRK9n8WKKDDRSzwZ4syKKf
wbkfj05vgFxrjCynVbm1zs2X2aGXh+PxPL/WHUaxzEP7KjYbLtCUZDRzOOrm+0LMktngT/k3
6+EZoLEM52hwwpIAzJoscyEz7QfqMOZtFm6xQnlvDQeIrHx0KUvwo/vgDLK3SuruG1CSHcR0
D24kEEUa044AIUKBS3b0b8AR7f6mP2NcnLpdsibtpabi9BzqAidcY/EjTaoea46HXALk/eJd
6OLkLE6UQe1PPzQC4jB7rErX2BxnSkHDw50xMgLRcl5/b1bOwE0EUhFfyAEIAKp7Cp8lqKTV
CC9QiAf6QTIjW+lie5J44Ad++0k8gRgANZVWubQuCQ71gxDWLtxYfFkEXjG4TXV/MUtnOliG
5rc2E+ih6Dg61Y5PQakm9OwPIsOx+2R+iSW325ngln2UQrVPgloO83QiUoi7mBJPbcHlxkhZ
bd3+EjFxSLIQogt29sTcg2oSh4oljUpz5niTt69IOfZx21kf29NfDE+Iw56gfrxI2ywZbu5o
G+d0ZSp0lsovygpk4jK04fDTq0vxjEU5HjPcsXC4CSZdq5E2DrF4nOh1UHkHzeaXdYR2Bn1Y
wTePfaHBFlvQzI+Li/Q6AD/uxbTM0vIcsUxrv3MNHCUAEQEAAcLBfgQYAQIACQUCUhFfyAIb
LgEpCRCTQwmyVcgNcsBdIAQZAQIABgUCUhFfyAAKCRC22tOSFDh1UOlBB/94RsCJepNvmi/c
YiNmMnm0mKb6vjv43OsHkqrrCqJSfo95KHyl5Up4JEp8tiJMyYT2mp4IsirZHxz/5lqkw9Az
tcGAF3GlFsj++xTyD07DXlNeddwTKlqPRi/b8sppjtWur6Pm+wnAHp0mQ7GidhxHccFCl65w
uT7S/ocb1MjrTgnAMiz+x87d48n1UJ7yIdI41Wpg2XFZiA9xPBiDuuoPwFj14/nK0elV5Dvq
4/HVgfurb4+fd74PV/CC/dmd7hg0ZRlgnB5rFUcFO7ywb7/TvICIIaLWcI42OJDSZjZ/MAzz
BeXm263lHh+kFxkh2LxEHnQGHCHGpTYyi4Z3dv03HtkH/1SI8joQMQq00Bv+RdEbJXfEExrT
u4gtdZAihwvy97OPA2nCdTAHm/phkzryMeOaOztI4PS8u2Ce5lUB6P/HcGtK/038KdX5MYST
Fn8KUDt4o29bkv0CUXwDzS3oTzPNtGdryBkRMc9b+yn9+AdwFEH4auhiTQXPMnl0+G3nhKr7
jvzVFJCRif3OAhEm4vmBNDE3uuaXFQnbK56GJrnqVN+KX5Z3M7X3fA8UcVCGOEHXRP/aubiw
Ngawj0V9x+43kUapFp+nF69R53UI65YtJ95ec4PTO/Edvap8h1UbdEOc4+TiYwY1TBuIKltY
1cnrjgAWUh/Ucvr++/KbD9tD6C8=
Message-ID: <a11eb188-e556-c08a-88e4-c9ab67b47d1d@huitema.net>
Date: Fri, 8 Jun 2018 18:13:29 -0700
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101
Thunderbird/52.8.0
MIME-Version: 1.0
In-Reply-To: <CAF8qwaCQRS00nJWtk3RBob82NbCfuD32uUJpzjgx=-FhxdWNDQ@mail.gmail.com>
Content-Type: multipart/alternative;
boundary="------------FDB0F60F341857B4434786B9"
Content-Language: en-US
X-Originating-IP: 168.144.250.245
X-AntiSpamCloud-Domain: xsmtpout.mail2web.com
X-AntiSpamCloud-Username: 168.144.250.0/24
Authentication-Results: antispamcloud.com; auth=pass
smtp.auth=168.144.250.0/24@xsmtpout.mail2web.com
X-AntiSpamCloud-Outgoing-Class: unsure
X-AntiSpamCloud-Outgoing-Evidence: Combined (0.15)
X-Recommended-Action: accept
X-Filter-ID: EX5BVjFpneJeBchSMxfU5sO6g8i30uqDZZuvbaEKlyF602E9L7XzfQH6nu9C/Fh9KJzpNe6xgvOx
q3u0UDjvO5IcVwV4jjVcAOtIXxgohGFVMZsRZacTbJPGp/MBC6Bxo2/sYV+AW/s7jTD/nqvHCUh5
mNm/WjPqhYqCeBiCKwzwNnO0oYiZjOnC1Xa7kCO2AIOsmfKTx05l1vgtiDJZqfvRa7MR4hgRIg8N
1QlY4G7x1YBTEs55LirRLgpsvCFtid7SQi4NE/job5y2wAN3GZxznd8NXwc/vKJtfZaXo5QAJAfA
9MMVcQ9WVjD1q+Rbd9IPG/DQ2p+GU04sTuYFs91jhnM/Mbva2XLV/LIEzaKyLm0zESXAkIAT8ZKA
DvsGI5uh86ZVnyOrYkLMWyEaRt9fxN2oReTDHAyOynaY0Cn4p2u0cbdyGTcIliCOXEyKIRFsicyJ
MEhQFtD8PLoiniWmsFByBoXAuCZEyg59LM/9rUJrEbVA84BZVscMTXpbwyPr6Ygmqufq1En6WLLn
AIHlTa0FG0ij7AOlTYklM4KgVlq0fCq5j5BFmf9FzY8/nnXm95a0vRtjH3/UwFOlrehiw2P3D5EI
+nblg037uMC3B+q+bUHXAsYFgsNREGhlzTFYPIyr5voE3ggyv83xvYRfyCMB4QZToA5YKb0SaS5E
llm5CBzrwBATJ22MAarYDrnzsG5f+caI1dL5Ye/k8E7k+vjbEFIODONvVl7uk81XeCuM9gAbuM3t
HWekNFdf6RNsrPZJFtxtX2KLfVwALdfH1yALUGC6BHMPRvkcc+0OvUbAhuBcxhaqUsiJeMQS9R/2
gMGq0KWAzmMf+ibVDq6cyN5oTOsLjetNPyF2Ho+qWKEc9MBxZCWS72/wjopIVAY+3RHRetx4B6Z4
Ei5woFss+n2ffnQxt6aJ7klZab+5U3mWTJPTqb+xVIKqgeO7n3iwosDmKSszPVW9RecIRsxn9uie
2n4+ooHGqAOWILQxL7hrJSk60SF3F6RYOYr2
X-Report-Abuse-To: spam@quarantine6.antispamcloud.com
Archived-At: <https://mailarchive.ietf.org/arch/msg/tls/IeYwnWnX9M9hDunhvCPLTFkWABA>
Subject: Re: [TLS] I-D Action: draft-ietf-tls-grease-01.txt
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.26
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working
group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>,
<mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>,
<mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sat, 09 Jun 2018 01:13:49 -0000
On 6/8/2018 7:35 AM, David Benjamin wrote: > On Fri, Jun 8, 2018 at 10:07 AM R duToit <r@nerd.ninja> wrote: > > > GREASE values should not make their way into code. The whole > point is to get code used to the fact that unknown values exist. > > The GREASE mechanism is useful, but it will definitely make its > way into code and become ossified itself. > Example: https://github.com/salesforce/ja3 > > > Indeed. GREASE was targeting normal sensible endpoint implementations... ... and maybe we need a different mechanism to defeat fingerprinting tools like this JA3 project. Maybe applications need to somehow randomize their signatures, so that they are not so easy to recognize. For example, it should be possible to use randomize the order of extensions. And it should also be possible to throw some grease in these sets. Of course, the first ones to develop and use these randomization techniques will most likely be the malware authors that the tools are allegedly trying to track. -- Christian Huitema
- Re: [TLS] I-D Action: draft-ietf-tls-grease-01.txt Hubert Kario
- Re: [TLS] I-D Action: draft-ietf-tls-grease-01.txt Hubert Kario
- Re: [TLS] I-D Action: draft-ietf-tls-grease-01.txt David Benjamin
- [TLS] I-D Action: draft-ietf-tls-grease-01.txt internet-drafts
- Re: [TLS] I-D Action: draft-ietf-tls-grease-01.txt David Benjamin
- Re: [TLS] I-D Action: draft-ietf-tls-grease-01.txt Benjamin Kaduk
- Re: [TLS] I-D Action: draft-ietf-tls-grease-01.txt R duToit
- Re: [TLS] I-D Action: draft-ietf-tls-grease-01.txt David Benjamin
- Re: [TLS] I-D Action: draft-ietf-tls-grease-01.txt Christian Huitema
- Re: [TLS] I-D Action: draft-ietf-tls-grease-01.txt Sean Turner