Re: [TLS] draft-green-tls-static-dh-in-tls13-01

Daniel Kahn Gillmor <dkg@fifthhorseman.net> Sat, 15 July 2017 11:19 UTC

Return-Path: <dkg@fifthhorseman.net>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 921DA131B0A for <tls@ietfa.amsl.com>; Sat, 15 Jul 2017 04:19:20 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.9
X-Spam-Level:
X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fwO29ARndZp3 for <tls@ietfa.amsl.com>; Sat, 15 Jul 2017 04:19:19 -0700 (PDT)
Received: from che.mayfirst.org (che.mayfirst.org [162.247.75.118]) by ietfa.amsl.com (Postfix) with ESMTP id 7F87C1317D2 for <tls@ietf.org>; Sat, 15 Jul 2017 04:19:19 -0700 (PDT)
Received: from fifthhorseman.net (dhcp-88bf.meeting.ietf.org [31.133.136.191]) by che.mayfirst.org (Postfix) with ESMTPSA id 088D8F999; Sat, 15 Jul 2017 07:19:16 -0400 (EDT)
Received: by fifthhorseman.net (Postfix, from userid 1000) id 520B420D76; Sat, 15 Jul 2017 13:19:13 +0200 (CEST)
From: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
To: Ilari Liusvaara <ilariliusvaara@welho.com>, "Dobbins, Roland" <rdobbins@arbor.net>
Cc: IETF TLS <tls@ietf.org>
In-Reply-To: <20170715085544.y3hozzzpqzrfacd7@LK-Perkele-VII>
References: <CAPCANN-xgf3auqy+pFfL6VO5GpEsCCHYkROAwiB1u=8a4yj+Fg@mail.gmail.com> <CAL02cgRJeauV9NQ2OrGK1ocQtg-M2tbWm2+5HUc4-Wc8KC3vxQ@mail.gmail.com> <71E07F32-230F-447C-B85B-9B3B4146D386@vigilsec.com> <39bad3e9-2e17-30f6-48a7-a035d449dce7@cs.tcd.ie> <CAJU8_nXBFkpncFDy4QFnd6hFpC7oOZn-F1-EuBC2vk3Y6QKq3A@mail.gmail.com> <f0554055-cdd3-a78c-8ab1-e84f9b624fda@cs.tcd.ie> <A0BEC2E3-8CF5-433D-BA77-E8474A2C922A@vigilsec.com> <87k23arzac.fsf@fifthhorseman.net> <C4968C13-3229-43C2-B29B-EC9C01D76D06@arbor.net> <20170715085544.y3hozzzpqzrfacd7@LK-Perkele-VII>
Date: Sat, 15 Jul 2017 13:19:10 +0200
Message-ID: <87379yrlqp.fsf@fifthhorseman.net>
MIME-Version: 1.0
Content-Type: multipart/signed; boundary="=-=-="; micalg="pgp-sha512"; protocol="application/pgp-signature"
Archived-At: <https://mailarchive.ietf.org/arch/msg/tls/KQW36tFT0gTTYk2yfaRyQ86bIB4>
Subject: Re: [TLS] draft-green-tls-static-dh-in-tls13-01
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sat, 15 Jul 2017 11:19:21 -0000

On Sat 2017-07-15 11:55:44 +0300, Ilari Liusvaara wrote:
> Oh, and like any backdoor, this backdoor too has variety of security
> problems. And your adversaries would absolutely love to be able to
> exploit _you_ using these problems, as that would make their lives much
> easier.

I'd like to hear from the people who are doing full-take network capture
within their datacenters about how they protect the security of the
internal decryption systems.  It certainly sounds like a tempting target
for any adversary interested in datacenter operations.

           --dkg