IETF Logo Mail Archive

Re: [TLS] datacenter TLS decryption as a three-party protocol

Ted Lemon <mellon@fugue.com> Sun, 23 July 2017 22:16 UTC

Return-Path: <mellon@fugue.com>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BD856126CC4 for <tls@ietfa.amsl.com>; Sun, 23 Jul 2017 15:16:48 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.899
X-Spam-Level:
X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 51mQBWF6HcF4 for <tls@ietfa.amsl.com>; Sun, 23 Jul 2017 15:16:47 -0700 (PDT)
Received: from mail-qt0-x231.google.com (mail-qt0-x231.google.com [IPv6:2607:f8b0:400d:c0d::231]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 18035126C23 for <tls@ietf.org>; Sun, 23 Jul 2017 15:16:46 -0700 (PDT)
Received: by mail-qt0-x231.google.com with SMTP id t37so7453631qtg.5 for <tls@ietf.org>; Sun, 23 Jul 2017 15:16:46 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=I/W4/LKByVMB95JWvHacp9bWAw7HZMnNDM/amj7gQVI=; b=JGsOO1dICTfB9N/f8lTxxCmLgWgyszrqe5mURokU+5VINjLoFRGfiMcvaCjCTnS+fS wwqgAwsoRc1uyRsebxk5C8mA+a6LkNUmAsarrQtmQV4PysLs5Nul6QYzfXceLGSPsGfI XjJ2Gy5Y5YWJ6HC9+00PO0DZ7spDtafuV7d8JyflRVCteJlk7eezGFTnhlP4RRMrwj3p OQLfWegKRUM+ULn4Ef4zvNDFdWPLR/crJDnZUwnhbvp8MZx3+56TCAU+yGdzpp8jg0T2 xbxd/lTIdiLAR98rZ8ieNl1RUUyvoeQ72DaskGpwBXwwKAKQ1RDFYR///SlbTCQsgV+8 Fx0g==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=I/W4/LKByVMB95JWvHacp9bWAw7HZMnNDM/amj7gQVI=; b=rGFVlGd9ZyDZRjDLesD7sLIGS/bZpuS1PcC9uj3wMBUIZwZxZxoEjIOZnu2UPjLVOn dCH04mBlgvX6+QK9ep5oZ+2mFK9iyRYyiPmLGhMVM9QBfpW5Jy+0iMFyKQowQjFK1HqZ jzbUfD9zjxdra8+7Kx89uKBR1EIOU3wvxaklGgw7La2BoGsdwG9zZAF93SttR3jHkfNn Rwj2JOrqspgAJleqq5belSq85J8mcOFCe4TpO2gAGXW+RAaGZvvwNvumxHq2ExNGwhY8 vdGHwAtCyyR4du3CU6rUN0B3hD0erSnNMwJRT/LK+1lX9k0TP7y3hsbuk8yrJe0TtmcZ 6u6A==
X-Gm-Message-State: AIVw113uF8b0/gs+hODyv7VXUuuRd/peDfYCLDhDoERmYLSzjLTz4IrI VjeJCFRLdz4U/RMh
X-Received: by 10.237.57.199 with SMTP id m65mr17560420qte.243.1500848205960; Sun, 23 Jul 2017 15:16:45 -0700 (PDT)
Received: from macbook-pro-6.w50.lede.home (c-73-167-64-188.hsd1.nh.comcast.net. [73.167.64.188]) by smtp.gmail.com with ESMTPSA id h41sm3886356qta.45.2017.07.23.15.16.44 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Sun, 23 Jul 2017 15:16:44 -0700 (PDT)
From: Ted Lemon <mellon@fugue.com>
Message-Id: <9429A78D-CE9A-4627-9F04-1B7FAF87CEB4@fugue.com>
Content-Type: multipart/alternative; boundary="Apple-Mail=_C56A83B5-D539-46EC-ACAF-720D2FA6C118"
Mime-Version: 1.0 (Mac OS X Mail 10.3 \(3273\))
Date: Sun, 23 Jul 2017 18:16:42 -0400
In-Reply-To: <318b4504-08b3-e2db-026b-a79ea4d1aec2@huitema.net>
Cc: tls@ietf.org
To: Christian Huitema <huitema@huitema.net>
References: <CAAF6GDeFuRy0DN6w3FwmR_nh1G=YBi4+qiEcw0MfSRj4SUCbZQ@mail.gmail.com> <20170720200114.AA2F91A6CB@ld9781.wdf.sap.corp> <06AE85BC-87AD-4CA5-8408-44F670358701@ll.mit.edu> <20170720203238.e66zurx5yn2jja3a@LK-Perkele-VII> <17109486-336E-44C0-B9FC-D65EE14310B5@ll.mit.edu> <20170723070240.x7kmynzmu4jqco5t@LK-Perkele-VII> <C0772D29-CB26-418F-981B-BC2E2435E655@ll.mit.edu> <35FD3356-8300-405A-B8D8-FC2574DB9A56@fugue.com> <CE89217F-972F-4F37-B8BA-925AE1FE8D68@ll.mit.edu> <44105D6B-4CE0-4C3C-ACFA-30EF1D8AA8F7@fugue.com> <318b4504-08b3-e2db-026b-a79ea4d1aec2@huitema.net>
X-Mailer: Apple Mail (2.3273)
Archived-At: <https://mailarchive.ietf.org/arch/msg/tls/RvTqyHnNP3fRNv8FL1wHEV3LHI0>
Subject: Re: [TLS] datacenter TLS decryption as a three-party protocol
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sun, 23 Jul 2017 22:16:49 -0000

On Jul 23, 2017, at 5:37 PM, Christian Huitema <huitema@huitema.net> wrote:
> Speaking of threat model, one of the main threats is the "Lavabit" case: a server is asked to somehow implement a backdoor so existing clients. In that case, it is very useful for clients to detect that something has changed. They can move away and use another server.

Clients cannot detect this backdoor.   They can be informed of it, but they can't detect it.

v2.23.0 | Report a Bug | By Email