Re: [TLS] Publication of draft-rhrd-tls-tls13-visibility-00

"Ackermann, Michael" <> Mon, 23 October 2017 23:31 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id A128013AC9E for <>; Mon, 23 Oct 2017 16:31:06 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -4.091
X-Spam-Status: No, score=-4.091 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, T_DKIM_INVALID=0.01] autolearn=ham autolearn_force=no
Authentication-Results: (amavisd-new); dkim=fail (1024-bit key) reason="fail (body has been altered)"
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id EkEgGI7Kwlhw for <>; Mon, 23 Oct 2017 16:31:05 -0700 (PDT)
Received: from ( []) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by (Postfix) with ESMTPS id DB84913AB3E for <>; Mon, 23 Oct 2017 16:31:04 -0700 (PDT)
Received: from (ZixVPM []) by (Proprietary) with SMTP id 06E02C0EA3 for <>; Mon, 23 Oct 2017 18:31:04 -0500 (CDT)
Received: from (unknown []) by (Proprietary) with SMTP id 0532AC0D6C; Mon, 23 Oct 2017 18:31:02 -0500 (CDT)
Received: from (unknown []) by IMSVA (Postfix) with ESMTP id 8672FFE05C; Mon, 23 Oct 2017 19:31:02 -0400 (EDT)
Received: from (unknown []) by IMSVA (Postfix) with ESMTP id 5904FFE048; Mon, 23 Oct 2017 19:31:02 -0400 (EDT)
Received: from (unknown []) by (Postfix) with ESMTPS; Mon, 23 Oct 2017 19:31:02 -0400 (EDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=selector1-bcbsm-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=sKPNQWou+6FZenPVh1N5dA8yVV/VaKxXkAtPILFSZXg=; b=SvA+KedO68BoxIyFP9CxZzlEvlCG+cd6DPWFEhn20wU83FPEsFlCle6bd9yZRpq4eusympcUTRchj41c6WJwwZULT1O69pdiLounIY8zNmjCIbsRkgMPkJ7dqHVuihGzv9K3flw/4Ytk/7XMdT0KLwa9C6LAPLY9a15UL9bEH6M=
Received: from ( by ( with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256) id; Mon, 23 Oct 2017 23:31:00 +0000
Received: from ([]) by ([]) with mapi id 15.20.0077.022; Mon, 23 Oct 2017 23:31:00 +0000
From: "Ackermann, Michael" <>
To: Benjamin Kaduk <>, Tony Arcieri <>, "Adam Caudill" <>
CC: "" <>
Thread-Topic: [TLS] Publication of draft-rhrd-tls-tls13-visibility-00
Date: Mon, 23 Oct 2017 23:31:00 +0000
Message-ID: <>
References: <> <> <> <> <> <> <> <> <> <> <> <> <> <> <> <>
In-Reply-To: <>
Accept-Language: en-US
Content-Language: en-US
authentication-results: spf=none (sender IP is );
x-originating-ip: []
x-ms-publictraffictype: Email
x-microsoft-exchange-diagnostics: 1; CY4PR14MB1365; 20:pK47S1MFZ20L5JTdFvfxtzKYttALgyuvg8SJ1n8kRa9J1Lmur5Mo0vR+bTiuWThbd2q26agwfnyRHqoYws9wxMqLb1Y3f+LqN9SXpovNmeMyBxnjLz3hnxt51TlTHrd+KrnhBp8pUVL7faOt5r88KcW/5ahVwwp4RBDpWBsEyIk=
x-ms-exchange-antispam-srfa-diagnostics: SSOS;
x-ms-office365-filtering-correlation-id: 597e3a88-71cc-496e-cdb1-08d51a6e1e82
x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001)(4534020)(4602075)(4627075)(201703031133081)(201702281549075)(2017052603199); SRVR:CY4PR14MB1365;
x-ms-traffictypediagnostic: CY4PR14MB1365:
x-exchange-antispam-report-test: UriScan:(190756311086443)(86572411397741);
x-microsoft-antispam-prvs: <>
x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(100000700101)(100105000095)(100000701101)(100105300095)(100000702101)(100105100095)(6040450)(2401047)(5005006)(8121501046)(100000703101)(100105400095)(3231020)(10201501046)(93006095)(93001095)(3002001)(6041248)(20161123558100)(20161123562025)(201703131423075)(201702281528075)(201703061421075)(201703061406153)(20161123564025)(20161123555025)(20161123560025)(6072148)(201708071742011)(100000704101)(100105200095)(100000705101)(100105500095); SRVR:CY4PR14MB1365; BCL:0; PCL:0; RULEID:(100000800101)(100110000095)(100000801101)(100110300095)(100000802101)(100110100095)(100000803101)(100110400095)(100000804101)(100110200095)(100000805101)(100110500095); SRVR:CY4PR14MB1365;
x-forefront-prvs: 046985391D
x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(6009001)(376002)(346002)(24454002)(199003)(189002)(13464003)(230783001)(55016002)(97736004)(4326008)(99286003)(3280700002)(53936002)(101416001)(6436002)(66066001)(2950100002)(76176999)(39060400002)(50986999)(25786009)(229853002)(6506006)(6116002)(3660700001)(14454004)(68736007)(54356999)(189998001)(2906002)(77096006)(2900100001)(81156014)(81166006)(8936002)(7696004)(86362001)(5660300001)(105586002)(110136005)(53546010)(93886005)(6246003)(72206003)(9686003)(74316002)(80792005)(305945005)(316002)(478600001)(8676002)(106356001)(3846002)(33656002)(7736002)(102836003); DIR:OUT; SFP:1102; SCL:1; SRVR:CY4PR14MB1365;; FPR:; SPF:None; PTR:InfoNoRecords; A:1; MX:1; LANG:en;
received-spf: None ( does not designate permitted sender hosts)
spamdiagnosticoutput: 1:99
spamdiagnosticmetadata: NSPM
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: base64
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-originalarrivaltime: 23 Oct 2017 23:31:00.1375 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 6f56d3fa-5682-4261-b169-bc0d615da17c
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY4PR14MB1365
X-VPM-GROUP-ID: f8ae9752-61e5-4e09-8866-6f8c695bbdac
X-VPM-MSG-ID: d68b120b-80f4-40ce-88be-504f228ff685
Archived-At: <>
Subject: Re: [TLS] Publication of draft-rhrd-tls-tls13-visibility-00
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Mon, 23 Oct 2017 23:31:06 -0000

The objective is to be passively observe, out of band and not to be a MitM or modify/inject text.    Just as we all do today.  

-----Original Message-----
From: Benjamin Kaduk [] 
Sent: Monday, October 23, 2017 6:33 PM
To: Ackermann, Michael <>;; Tony Arcieri <>;; Adam Caudill <>;
Subject: Re: [TLS] Publication of draft-rhrd-tls-tls13-visibility-00

On 10/23/2017 05:09 PM, Ackermann, Michael wrote:
> No one I am aware of is pushing for a MitM capability to address this.   
> In fact it was one of the alternative solutions for which many 
> implementation issues were cited at the Prague meeting and on this 
> list.    But I would like to ask,  what is the solution that your 
> company and others that you reference,  have solved this problem by 
> implementing?

Is not draft-rhrd-tls-tls13-visibility a MitM, in that the holder of the
SSWrapDH1 private key has the cryptographic capability to inject traffic and modify plaintext for the affected connections?


The information contained in this communication is highly confidential and is intended solely for the use of the individual(s) to whom this communication is directed. If you are not the intended recipient, you are hereby notified that any viewing, copying, disclosure or distribution of this information is prohibited. Please notify the sender, by electronic mail or telephone, of any unintended receipt and delete the original message without making any copies.
 Blue Cross Blue Shield of Michigan and Blue Care Network of Michigan are nonprofit corporations and independent licensees of the Blue Cross and Blue Shield Association.