Re: [TLS] chairs - please shutdown wiretapping discussion...

On Sat, Jul 8, 2017 at 11:31 AM, Paul Turner <PAUL.TURNER@venafi.com> wrote:
>
> The Internet Draft describes the use of static (EC)DHE for traffic
> entirely inside enterprise networks and intends to clearly state that it
> should not be used for "information passed across the Internet". If we have
> not been clear enough on that in the document, please tell us how we can be
> more clear. Assuming that the document is clear on this point, it would not
> then apply to "wiretapping" as defined in RFC 2804 (as Russ mentioned in an
> earlier email).
>

The IETF's position as expressed in 2804 is on technologies that
"facilitate" wiretapping. What the RFC says the protocol is "intended for"
in layer 8 isn't as relevant as how the technology could easily be used,
once standardized.

The burden on the proposers should be to demonstrate that the technology
can *only* be used in the manner of its stated intent, even if the humans
involved were all hostile, or compelled to be hostile.

You have stated that there are alternatives by using proxies but enterprise
> organizations have stated this is not viable due to the complexity and
> scale of their network environments.

Not all statements are created equal. Stating that proxies can technically
fulfill this function is objective, and can be backed up in clear technical
detail.

Stating that proxies are not viable for enterprise organizations due to the
scale and complexity of their network environments is subjective, generally
not well-detailed, and much more open to skepticism.

The burden on the proposers should be to address this skepticism, and to
justify to the working group why enterprises that are large enough and
well-funded enough to have such vast and complex networks cannot invest in
upgrading those networks to an approach that doesn't rely on directly
weakening their own connection security and potentially the security of
others' through the unintended consequences of formalizing this RFC.

> Our collective objective is to increase the security of the Internet at
> large. As such, we have proposed this RFC in order to ensure that TLS 1.3
> is adopted as broadly as possible inside of enterprises, which is an
> important step in increasing security.

So is increasing the use of forward secret connections within enterprise
network environments. Why should the TLS WG accept the argument that legacy
approaches to monitoring enterprise networks are worth risking the
weakening of the product of years of hard work?

-- Eric

-----Original Message-----
> From: TLS [mailto:tls-bounces@ietf.org] On Behalf Of Stephen Farrell
> Sent: Saturday, July 8, 2017 10:33
> To: Yaron Sheffer <yaronf.ietf@gmail.com>; tls chair <
> tls-chairs@tools.ietf.org>
> Cc: tls@ietf.org
> Subject: Re: [TLS] chairs - please shutdown wiretapping discussion...
>
>
>
> On 08/07/17 15:27, Yaron Sheffer wrote:
> > Hi Stephen,
> >
> > Like you, I am very unhappy with this draft, and would not support its
> > adoption as a WG draft. However I think that open discussion is in
> > general good, and that the best venue for discussion of this draft is
> > this mailing list. Even if some of this discussion devolves into
> > generic "are we pro or against wiretapping" questions.
>
> FWIW I believe that we have had that discussion about breaking tls over
> and over on this and other lists. I see no value in doing it yet again,
> even if the proximate cause is a new variation of the "here's a way to
> break tls" class of drafts. (Someday we should find someone who'd document
> all the broken break-tls ideas that have been rightly rejected over the
> years.)
>
> >
> > I don't think this is a significant distraction that could derail
> > (D)TLS, moreover, you will recall that in Chicago several new drafts
> > were adopted to the working group. So the WG does feel that TLS is in
> > good enough shape that we can spend some bandwidth on other things.
>
> Maybe I'm more easily distracted, at least by this topic;-)
>
> Anyway, I'm fine that it's for the chairs to figure that out.
>
> S.
>
>
> > Thanks,
> >
> >     Yaron
> >
> >
> > On 08/07/17 12:17, Stephen Farrell wrote:
> >> Sean/Joe,
> >>
> >> This is a request that you, as chairs, shut down the distracting
> >> wiretapping discussion, at least until DTLS1.3 is done.
> >>
> >> I have planned to spend time reading draft 21 and DTLS, but that
> >> won't happen if we keep having to fight off the latest attempts to
> >> break TLS. I'd not be surprised if I weren't the only one finding
> >> that distraction an irritating waste of time. Finishing
> >> TLS1.3 and getting DTLS1.3 on the way surely needs to not be
> >> constantly de-railed by these attempts to break TLS.
> >>
> >> Therefore I'd ask that you declare this discussion closed for at
> >> least that long (i.e until DTLS1.3 is done).
> >>
> >> I'd also ask that you not allocate agenda time for wiretapping in
> >> Prague.
> >>
> >> Thanks,
> >> S.
> >>
> >>
> >>
> >> _______________________________________________
> >> TLS mailing list
> >> TLS@ietf.org
> >> https://www.ietf.org/mailman/listinfo/tls
> >
> >
>
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls
>

-- 
konklone.com | @konklone <https://twitter.com/konklone>