[TLS] looking to hold a TLS VPN side meeting at IETF 92

["Boyle, Vincent M" <[e-mail]>]

Hi all,
                I'm planning to hold a side meeting at IETF 92 to gauge interest in creating a standard for TLS VPNs. One motivating use case for my organization is the need to  protect data between an app on a mobile device and the enterprise network that it connects to.  For many of our customers, a TLS-based solution is preferable to IPSec (perhaps because their vendors support the former). For some sensitive military applications, there is a requirement to provide two layers of encryption, so using TLS for the second layer makes sense. Having each app invoke TLS is problematic because it introduces validation costs for each app before it is deployed (to ensure that it correctly implements TLS or makes the appropriate OS calls). We would prefer the option of validating a TLS VPN product and having it available for use by all apps on the device. To create the necessary validation requirements and test activities, we need to have a standard that we can point to.  The development of an open standard would provide a consistent and fair method of measuring security (using Protection Profiles) which scales to enable the validation and testing of TLS VPNs.

                Beyond this specific (but fairly pressing) use case, we believe that there are many organizations that would benefit from the availability of a standards-based, validated mechanism to protect communications between their mobile devices and the enterprise network.

                Please discuss on the  saag mail list. I will schedule a meeting time at a local drinking establishment for either Monday or Wednesday at 7:30 PM (local Dallas time). I'd appreciate feedback on the meeting times (if you expect to attend) as well as any comment on the usefulness or feasibility of this effort.

Thanks,
Mike Boyle
Standards Lead
Information Assurance Directorate, NSA