Re: [TLS] draft-green-tls-static-dh-in-tls13-01
Martin Thomson <martin.thomson@gmail.com> Wed, 12 July 2017 01:39 UTC
Return-Path: <martin.thomson@gmail.com>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5169512EC46 for <tls@ietfa.amsl.com>; Tue, 11 Jul 2017 18:39:27 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.7
X-Spam-Level:
X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Wq4vN1CuPIbT for <tls@ietfa.amsl.com>; Tue, 11 Jul 2017 18:39:26 -0700 (PDT)
Received: from mail-io0-x232.google.com (mail-io0-x232.google.com [IPv6:2607:f8b0:4001:c06::232]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1FF9512F287 for <tls@ietf.org>; Tue, 11 Jul 2017 18:39:26 -0700 (PDT)
Received: by mail-io0-x232.google.com with SMTP id h64so5076620iod.0 for <tls@ietf.org>; Tue, 11 Jul 2017 18:39:26 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=EVcny16ck/u61FZw/tVHVs7exX7JMFMTBNoibU9lEVY=; b=j3KAQJaBhdadNyiZKUed/p+3W7/1eCLqV1K9pba1qRAoVeOTdpn9khnJYXGSwh8ywg +cTuFhkYNYNcEkF+TQg0kogFK8YNC9/qJMevWzXLo7f3VCQniPtr/hAyvhrFPyB9R+Qh 99nUeUhf/gISRR+Rowm2teCNOhPvLi3oZ4i0dB5UVhFtQltfkoptDRiTTOh3gKx73HYN P7+/DpI0DV3m7MJeX5nezgc9CvQFdvSn1lEfIzEEVs572QEbJq58ClULbNMBWd5zktW8 WYA1ETfy3JZcWDcCifE10QaXYnQmAmT5V1s0u+gubUNRoiNo1DkRhbCT9ksZTQuH9PIs aiFg==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=EVcny16ck/u61FZw/tVHVs7exX7JMFMTBNoibU9lEVY=; b=UbdRR1EP/BTFHlslwFCj1Oyor/6jMxewgJjv0Yu02dvMOlckpGJdXoDuGFk0nINRya nwbk2AwHbufK6939/ylebIQTMFzMXd2ts4QHB2xknc10wkSXRkr0bXh2/RFLJk4I5Izk 4VYWPlt/dyGDgmIGw8rll4H4fuQv7tKKUwiUfUKjwsULFc6WlhZuCh/N7YH9uJ3BIMnE XU1oL/amac/BfD7Jk0hVoRThXDBTw+JBwO4Av/gRAHzyu4MDQraaxveX66bTCMlT+Qg9 aJUbyKf5OMTKFJz8e26DwQZgm3jkQO33dZSgkOHQYtlQNBaqnC/tRxK20h+oO+dArtTj 8aaQ==
X-Gm-Message-State: AIVw110FvGmG2tfJj3eGHX6EXgONWN5pW7caM6657Q9qJQha4tCB7oGp sO8PPwRGj+1C6yT8P2ZTkDKpUrVwFQ==
X-Received: by 10.107.39.205 with SMTP id n196mr2978110ion.37.1499823565524; Tue, 11 Jul 2017 18:39:25 -0700 (PDT)
MIME-Version: 1.0
Received: by 10.107.164.26 with HTTP; Tue, 11 Jul 2017 18:39:24 -0700 (PDT)
In-Reply-To: <2F25802B-195C-47A9-8270-5EF487A1F925@gmail.com>
References: <D7648213-261E-4A26-BD6A-A5CB7F036D2C@gmail.com> <e0f078a7-5ef7-7cd2-8e88-dceea13638e7@cs.tcd.ie> <2F25802B-195C-47A9-8270-5EF487A1F925@gmail.com>
From: Martin Thomson <martin.thomson@gmail.com>
Date: Wed, 12 Jul 2017 11:39:24 +1000
Message-ID: <CABkgnnU5XTYPoTS8if7H+TknH3JtitRYbL3OnZRyF5UDcEd43w@mail.gmail.com>
To: Steve Fenter <steven.fenter58@gmail.com>
Cc: Stephen Farrell <stephen.farrell@cs.tcd.ie>, "tls@ietf.org" <tls@ietf.org>
Content-Type: text/plain; charset="UTF-8"
Archived-At: <https://mailarchive.ietf.org/arch/msg/tls/Pk6lOjNXZuMvdi0iIaZdWzmiCek>
Subject: Re: [TLS] draft-green-tls-static-dh-in-tls13-01
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 12 Jul 2017 01:39:27 -0000
On 12 July 2017 at 09:59, Steve Fenter <steven.fenter58@gmail.com> wrote: >> And if you had one an estimate for how much malware does it's own >> obfuscation or home-grown crypto in addition or instead of using TLS. >> The reason to ask is that as soon as malware does that then you >> are back to analysis based on ciphertext only. From descriptions >> of advanced attack schemes, they do seem to do both when calling >> home or exfiltrating data. In which case I think your argument >> falls. > > I don't have any numbers for home-grown crypto. I would think the odds are better for the enterprise if they can decrypt and inspect whatever portion is TLS. Wouldn't malware avoid connecting to servers that offer the wrong credentials? Implementing elementary key pinning or overriding trust anchors is pretty trivial - it's a feature that enterprises frequently rely on after all.
- [TLS] draft-green-tls-static-dh-in-tls13-01 Steve Fenter
- Re: [TLS] draft-green-tls-static-dh-in-tls13-01 Ted Lemon
- Re: [TLS] draft-green-tls-static-dh-in-tls13-01 Stephen Farrell
- Re: [TLS] draft-green-tls-static-dh-in-tls13-01 Steve Fenter
- Re: [TLS] draft-green-tls-static-dh-in-tls13-01 Ted Lemon
- Re: [TLS] draft-green-tls-static-dh-in-tls13-01 Martin Thomson
- Re: [TLS] draft-green-tls-static-dh-in-tls13-01 Kathleen Moriarty