Re: [TLS] TLS Impact on Network Security draft updated
Watson Ladd <watsonbladd@gmail.com> Tue, 23 July 2019 21:09 UTC
Return-Path: <watsonbladd@gmail.com>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 247FE120A0C for <tls@ietfa.amsl.com>; Tue, 23 Jul 2019 14:09:59 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.997
X-Spam-Level:
X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id CJXG9d_K3Ne1 for <tls@ietfa.amsl.com>; Tue, 23 Jul 2019 14:09:56 -0700 (PDT)
Received: from mail-lj1-x229.google.com (mail-lj1-x229.google.com [IPv6:2a00:1450:4864:20::229]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D6B8A1209C6 for <tls@ietf.org>; Tue, 23 Jul 2019 14:09:55 -0700 (PDT)
Received: by mail-lj1-x229.google.com with SMTP id m23so42346061lje.12 for <tls@ietf.org>; Tue, 23 Jul 2019 14:09:55 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=LsKoG9VIsT7zXF+JoQg4hXtFTcqa81V5IViPgWKDcp8=; b=uvBFNBu81BhCaHV2tZ8Kbhu4NFaM2wrBZM/DkeZfC0PtgF7ZJUxsT2PsAyJcYyn93V A6L79Qbn07eH/Ul8wkcRRlFcZGMUeJgLU8irCh4z/WQ7eW1VWO2aiVE1RNU7N/RZptF8 NjEfMj2fIpP2G9ITQtnjJtibvbn/hQ91CjofBTCtOCrWdgJFBu8Gy3+GTntmXrIYnD+o t3N5Zo5k3+JJNPnk1cGZ4wHL2sxH8I3Hx6r5XddW/zVy/b9f8XElTQZ0Y/gd7SToOXLu ov29T+pB1A3Uht5Q0fpDEnpw/t5yfyCqB0rEURTzRuvbgWPxZOp5r1dRfExD51CFVxu9 qv/w==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=LsKoG9VIsT7zXF+JoQg4hXtFTcqa81V5IViPgWKDcp8=; b=Ann1mijwvTlRXflxRdRijsnxsDHkT3yDkxBbjQ2++LLuBh3qRnkwtUwdsEn2Ul+z/m Bhu/QiDq2I46VCEatF3xaHHiSISXHm9yxvNaTppnHDfIxvL2PDtXJ+WiI/oOy1UeZWJH 9f7VIzXlsHPYDcoYQKOY5nV0R2SO4za3ZH1ykFjYehXlAbnNVNRIBDt0sPYnknJWYvr9 431PX7yKP/xnBuiVwDGOQmI1MiTFlPYNPuOejR7e1+o9KA5fHvJkWbVq35224Aw3fFCo kSV/lwZFT7uNL03hNDhGD7ggt0I1m/6ZwS61KTi+FKkfP2nMgt/ofrmqjGmEgMWD4jHD bNYA==
X-Gm-Message-State: APjAAAU6riOA20Yc67hvYy3uPxMB0Q0QbELMLNzs9dupPz2FsclETF2D 5cbDTnetdg2HdG5oBgF6Xf6Jd4LN3FttaM+qmvM=
X-Google-Smtp-Source: APXvYqwBIZeIknY98o/c7sv7tCTkjElPa6AAPJx2DruG3FdV+GyM5txjNQ11696ShmTgcjRvkKwK33poRBn20EntZNE=
X-Received: by 2002:a2e:b0e6:: with SMTP id h6mr38969757ljl.18.1563916194022; Tue, 23 Jul 2019 14:09:54 -0700 (PDT)
MIME-Version: 1.0
References: <6AF48228-19C2-41C7-BA86-BA16940C3CFF@cisco.com> <E73DC7CA-71F1-4309-BBC9-6DF776E04350@gmail.com> <CACsn0ck3=wdt5954CvNRbNS3s+qn5NGOUZm0j6P=yA9unCzsQQ@mail.gmail.com> <016da638-6973-809b-0a24-42b2c9682b64@cisco.com>
In-Reply-To: <016da638-6973-809b-0a24-42b2c9682b64@cisco.com>
From: Watson Ladd <watsonbladd@gmail.com>
Date: Tue, 23 Jul 2019 14:09:41 -0700
Message-ID: <CACsn0c=MjYEcjW-d80FpAVX7un4X7J5q+=wwieHghg5fWVfQyw@mail.gmail.com>
To: "Flemming Andreasen (fandreas)" <fandreas@cisco.com>
Cc: Bret Jordan <jordan.ietf@gmail.com>, TLS List <tls@ietf.org>
Content-Type: multipart/alternative; boundary="000000000000340a34058e5f9d2e"
Archived-At: <https://mailarchive.ietf.org/arch/msg/tls/RrrwcKRTT1A1_JnHWCNLENWVUbA>
Subject: Re: [TLS] TLS Impact on Network Security draft updated
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 23 Jul 2019 21:10:06 -0000
On Tue, Jul 23, 2019, 1:51 PM Flemming Andreasen <fandreas@cisco.com> wrote: > > > On 7/23/19 2:35 PM, Watson Ladd wrote: > > This draft contains substantial omissions in section 3. > > Nothing in TLS 1.3 prevents scanning for servers and examining the > certificates they present. > > Agreed, however there is no guarantee that the server will present the > same certificate and other TLS parameters as it will for a particular > client connection > True but for 99% (WAG) of setups this is driven by SNI and ciphersuite which you see in the clear. Nothing in TLS 1.3 prevents using reverse proxies to provide WAF > functionality. > > Agreed however you need to terminate the TLS 1.3 connection at that WAF > That doesn't sound like a big difficulty especially given the WAF was intercepting and decrypting before. What is the gain here? It's also more secure: there is fun with headers that doesnt work if the WAF normalizes. PCI-DSS compliance is not at odds with deploying TLS 1.3. In fact the > citation to A2 is to a sun-setting of all pre TLS 1.2 versions for point of > sale terminals. I really don't see where the conflict exists since all > ciphers in 1.3 are secure. > > I'll defer to one of my co-authors on this one. > > The absence of these solutions means the draft overstates the impact of > the increased protection TLS 1.3 provides. It's disappointing to see > sustained and persistent opposition to encryption and privacy despite > multiple RFCs saying that yes we should encrypt all the things. > > The draft is submitted with the intent of informing the community about > impacts as we see them. The authors welcome discussion and constructive > feedback and we will be happy to update and improve the draft accordingly > when such information is provided and consensus forms around it. Specific > text suggestions will be even better. > I seem to remember a discussion during the last call of TLS 1.3 where these issues were raised. I think at minimum pointing out that this only affects some networks with some choices of how to do things and that other techniques (like reverse proxies) can achieve the same ends is necessary if the goal is actually to help operators cope with TLS 1.3. > Thanks > > -- Flemming > > > On Tue, Jul 23, 2019, 8:08 AM Bret Jordan <jordan.ietf@gmail.com> wrote: > >> Nancy, >> >> I support this work and think this draft should be published. This is a >> yet another good write up on some of the requirements that are needed for >> operational security. >> >> Thanks, >> Bret >> PGP Fingerprint: 63B4 FC53 680A 6B7D 1447 F2C0 74F8 ACAE 7415 0050 >> "Without cryptography vihv vivc ce xhrnrw, however, the only thing that >> can not be unscrambled is an egg." >> >> On Jul 21, 2019, at 9:51 AM, Nancy Cam-Winget (ncamwing) < >> ncamwing@cisco.com> wrote: >> >> Hi, >> Thanks to all the feedback provided, we have updated the >> https://tools.ietf.org/html/draft-camwinget-tls-use-cases-04 >> draft. At this point, we believe the draft is stable and would like to >> request its publication as an informational draft. >> >> Warm regards, >> Nancy >> >> >> _______________________________________________ >> TLS mailing list >> TLS@ietf.org >> https://www.ietf.org/mailman/listinfo/tls >> >> >> _______________________________________________ >> TLS mailing list >> TLS@ietf.org >> https://www.ietf.org/mailman/listinfo/tls >> > > _______________________________________________ > TLS mailing listTLS@ietf.orghttps://www.ietf.org/mailman/listinfo/tls > > >
- [TLS] TLS Impact on Network Security draft updated Nancy Cam-Winget (ncamwing)
- Re: [TLS] TLS Impact on Network Security draft up… Eric Rescorla
- Re: [TLS] TLS Impact on Network Security draft up… Bret Jordan
- Re: [TLS] TLS Impact on Network Security draft up… Watson Ladd
- Re: [TLS] TLS Impact on Network Security draft up… Tony Arcieri
- Re: [TLS] TLS Impact on Network Security draft up… Viktor Dukhovni
- Re: [TLS] TLS Impact on Network Security draft up… Mark O
- Re: [TLS] TLS Impact on Network Security draft up… Ackermann, Michael
- Re: [TLS] TLS Impact on Network Security draft up… Flemming Andreasen
- Re: [TLS] TLS Impact on Network Security draft up… Sean Turner
- Re: [TLS] TLS Impact on Network Security draft up… Flemming Andreasen
- Re: [TLS] TLS Impact on Network Security draft up… Flemming Andreasen
- Re: [TLS] TLS Impact on Network Security draft up… Salz, Rich
- Re: [TLS] TLS Impact on Network Security draft up… Watson Ladd
- Re: [TLS] TLS Impact on Network Security draft up… Bret Jordan
- Re: [TLS] TLS Impact on Network Security draft up… Arnaud.Taddei.IETF
- Re: [TLS] TLS Impact on Network Security draft up… Ackermann, Michael
- Re: [TLS] TLS Impact on Network Security draft up… Dennis Jackson
- Re: [TLS] TLS Impact on Network Security draft up… Eric Rescorla
- Re: [TLS] TLS Impact on Network Security draft up… Filippo Valsorda
- Re: [TLS] TLS Impact on Network Security draft up… Bret Jordan
- Re: [TLS] TLS Impact on Network Security draft up… Watson Ladd
- Re: [TLS] TLS Impact on Network Security draft up… Dennis Jackson
- Re: [TLS] TLS Impact on Network Security draft up… Bret Jordan
- Re: [TLS] TLS Impact on Network Security draft up… Salz, Rich
- Re: [TLS] TLS Impact on Network Security draft up… Benjamin Kaduk
- Re: [TLS] TLS Impact on Network Security draft up… Ackermann, Michael
- Re: [TLS] TLS Impact on Network Security draft up… Watson Ladd
- Re: [TLS] TLS Impact on Network Security draft up… Dennis Jackson
- Re: [TLS] TLS Impact on Network Security draft up… Joseph Birr-Pixton
- Re: [TLS] TLS Impact on Network Security draft up… Benjamin Kaduk
- Re: [TLS] TLS Impact on Network Security draft up… Hubert Kario
- Re: [TLS] TLS Impact on Network Security draft up… Salz, Rich
- Re: [TLS] TLS Impact on Network Security draft up… Stephen Farrell
- [TLS] redirecting discussion (was Re: TLS Impact … Sean Turner
- Re: [TLS] TLS Impact on Network Security draft up… N6Ghost