Re: [TLS] Publication of draft-rhrd-tls-tls13-visibility-00

"Ackermann, Michael" <MAckermann@bcbsm.com> Mon, 23 October 2017 23:31 UTC

Return-Path: <mackermann@bcbsm.com>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A128013AC9E for <tls@ietfa.amsl.com>; Mon, 23 Oct 2017 16:31:06 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -4.091
X-Spam-Level:
X-Spam-Status: No, score=-4.091 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, T_DKIM_INVALID=0.01] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=fail (1024-bit key) reason="fail (body has been altered)" header.d=bcbsm.onmicrosoft.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id EkEgGI7Kwlhw for <tls@ietfa.amsl.com>; Mon, 23 Oct 2017 16:31:05 -0700 (PDT)
Received: from mx.z120.zixworks.com (bcbsm.zixworks.com [199.30.235.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DB84913AB3E for <tls@ietf.org>; Mon, 23 Oct 2017 16:31:04 -0700 (PDT)
Received: from 127.0.0.1 (ZixVPM [127.0.0.1]) by Outbound.z120.zixworks.com (Proprietary) with SMTP id 06E02C0EA3 for <tls@ietf.org>; Mon, 23 Oct 2017 18:31:04 -0500 (CDT)
Received: from imsva2.bcbsm.com (unknown [12.107.172.81]) by mx.z120.zixworks.com (Proprietary) with SMTP id 0532AC0D6C; Mon, 23 Oct 2017 18:31:02 -0500 (CDT)
Received: from imsva2.bcbsm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 8672FFE05C; Mon, 23 Oct 2017 19:31:02 -0400 (EDT)
Received: from imsva2.bcbsm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 5904FFE048; Mon, 23 Oct 2017 19:31:02 -0400 (EDT)
Received: from NAM02-SN1-obe.outbound.protection.outlook.com (unknown [216.32.180.17]) by imsva2.bcbsm.com (Postfix) with ESMTPS; Mon, 23 Oct 2017 19:31:02 -0400 (EDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=bcbsm.onmicrosoft.com; s=selector1-bcbsm-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=sKPNQWou+6FZenPVh1N5dA8yVV/VaKxXkAtPILFSZXg=; b=SvA+KedO68BoxIyFP9CxZzlEvlCG+cd6DPWFEhn20wU83FPEsFlCle6bd9yZRpq4eusympcUTRchj41c6WJwwZULT1O69pdiLounIY8zNmjCIbsRkgMPkJ7dqHVuihGzv9K3flw/4Ytk/7XMdT0KLwa9C6LAPLY9a15UL9bEH6M=
Received: from CY4PR14MB1368.namprd14.prod.outlook.com (10.172.158.148) by CY4PR14MB1365.namprd14.prod.outlook.com (10.172.158.145) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256) id 15.20.77.7; Mon, 23 Oct 2017 23:31:00 +0000
Received: from CY4PR14MB1368.namprd14.prod.outlook.com ([10.172.158.148]) by CY4PR14MB1368.namprd14.prod.outlook.com ([10.172.158.148]) with mapi id 15.20.0077.022; Mon, 23 Oct 2017 23:31:00 +0000
From: "Ackermann, Michael" <MAckermann@bcbsm.com>
To: Benjamin Kaduk <bkaduk@akamai.com>, Tony Arcieri <bascule@gmail.com>, "Adam Caudill" <adam@adamcaudill.com>
CC: "tls@ietf.org" <tls@ietf.org>
Thread-Topic: [TLS] Publication of draft-rhrd-tls-tls13-visibility-00
Thread-Index: AQHTO710HVvcnaInjUunozwwxCXv1qLp+S4AgAFTKoCAAAWPgIAAANmAgAABFgCAAAA7gIAAAPWAgAADKICAAALZAIAABTaAgAACs4CAAAEIAIAABEYAgAAZuoCAAAV4gIAAVLoAgAD/VwCAABsIAIAADvYAgAAFHmCAAAbigIADZUkAgAAIFICAAB86QIAACamAgAD42jCAABKIgIAACV1AgAADZ4CAAAF70IAAA1UAgAAA2TCAABBTAIAAGDwAgAAqLYCAAAW3AIAACFwAgAAOs/A=
Date: Mon, 23 Oct 2017 23:31:00 +0000
Message-ID: <CY4PR14MB1368BC5ED91EB52D702C7C76D7460@CY4PR14MB1368.namprd14.prod.outlook.com>
References: <7E6C8F1F-D341-456B-9A48-79FA7FEC0BC1@gmail.com> <2EE9CB23-AEDA-4155-BF24-EBC70CD302EF@fugue.com> <CY4PR14MB136816569A2AE2A9760C6E08D7410@CY4PR14MB1368.namprd14.prod.outlook.com> <557F43AC-A236-47BB-8C51-EDD37D09D5CB@fugue.com> <CY4PR14MB13684F18AD75F4AE767CE35CD7460@CY4PR14MB1368.namprd14.prod.outlook.com> <57CFBA2A-E878-47B0-8284-35369D4DA2DF@fugue.com> <CY4PR14MB13680B6D5726D940C4C51B4BD7460@CY4PR14MB1368.namprd14.prod.outlook.com> <0D75E20C-135D-45BC-ABE4-5C737B7491C9@akamai.com> <CY4PR14MB1368378B42A6C46B27F5EF01D7460@CY4PR14MB1368.namprd14.prod.outlook.com> <2AC16F9E-C745-43AD-82C1-D3953D51816C@fugue.com> <CY4PR14MB1368895DD0D72286635E4E83D7460@CY4PR14MB1368.namprd14.prod.outlook.com> <E37A3920-D7E3-4C94-89D0-6D3ECDEBCFF6@fugue.com> <CAFJuDmMZMRqvhyLFMoUo_5KPaVu3d4o2ZEQ_PiAOxWe7CtGgYQ@mail.gmail.com> <CAHOTMVJZpWfdCSrzYXhb5-gyzpjuNzoEMjM9DywqRu6Q8op_vw@mail.gmail.com> <CY4PR14MB1368C52236964E69E1F124FBD7460@CY4PR14MB1368.namprd14.prod.outlook.com> <17ae3ecd-ab72-59ac-c0fd-fb040dc67faa@akamai.com>
In-Reply-To: <17ae3ecd-ab72-59ac-c0fd-fb040dc67faa@akamai.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
authentication-results: spf=none (sender IP is ) smtp.mailfrom=MAckermann@bcbsm.com;
x-originating-ip: [165.225.39.61]
x-ms-publictraffictype: Email
x-microsoft-exchange-diagnostics: 1; CY4PR14MB1365; 20:pK47S1MFZ20L5JTdFvfxtzKYttALgyuvg8SJ1n8kRa9J1Lmur5Mo0vR+bTiuWThbd2q26agwfnyRHqoYws9wxMqLb1Y3f+LqN9SXpovNmeMyBxnjLz3hnxt51TlTHrd+KrnhBp8pUVL7faOt5r88KcW/5ahVwwp4RBDpWBsEyIk=
x-ms-exchange-antispam-srfa-diagnostics: SSOS;
x-ms-office365-filtering-correlation-id: 597e3a88-71cc-496e-cdb1-08d51a6e1e82
x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001)(4534020)(4602075)(4627075)(201703031133081)(201702281549075)(2017052603199); SRVR:CY4PR14MB1365;
x-ms-traffictypediagnostic: CY4PR14MB1365:
x-exchange-antispam-report-test: UriScan:(190756311086443)(86572411397741);
x-microsoft-antispam-prvs: <CY4PR14MB13659A56C2FEEF81F7FAA42AD7460@CY4PR14MB1365.namprd14.prod.outlook.com>
x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(100000700101)(100105000095)(100000701101)(100105300095)(100000702101)(100105100095)(6040450)(2401047)(5005006)(8121501046)(100000703101)(100105400095)(3231020)(10201501046)(93006095)(93001095)(3002001)(6041248)(20161123558100)(20161123562025)(201703131423075)(201702281528075)(201703061421075)(201703061406153)(20161123564025)(20161123555025)(20161123560025)(6072148)(201708071742011)(100000704101)(100105200095)(100000705101)(100105500095); SRVR:CY4PR14MB1365; BCL:0; PCL:0; RULEID:(100000800101)(100110000095)(100000801101)(100110300095)(100000802101)(100110100095)(100000803101)(100110400095)(100000804101)(100110200095)(100000805101)(100110500095); SRVR:CY4PR14MB1365;
x-forefront-prvs: 046985391D
x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(6009001)(376002)(346002)(24454002)(199003)(189002)(13464003)(230783001)(55016002)(97736004)(4326008)(99286003)(3280700002)(53936002)(101416001)(6436002)(66066001)(2950100002)(76176999)(39060400002)(50986999)(25786009)(229853002)(6506006)(6116002)(3660700001)(14454004)(68736007)(54356999)(189998001)(2906002)(77096006)(2900100001)(81156014)(81166006)(8936002)(7696004)(86362001)(5660300001)(105586002)(110136005)(53546010)(93886005)(6246003)(72206003)(9686003)(74316002)(80792005)(305945005)(316002)(478600001)(8676002)(106356001)(3846002)(33656002)(7736002)(102836003); DIR:OUT; SFP:1102; SCL:1; SRVR:CY4PR14MB1365; H:CY4PR14MB1368.namprd14.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; A:1; MX:1; LANG:en;
received-spf: None (protection.outlook.com: bcbsm.com does not designate permitted sender hosts)
spamdiagnosticoutput: 1:99
spamdiagnosticmetadata: NSPM
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: base64
MIME-Version: 1.0
X-OriginatorOrg: bcbsm.com
X-MS-Exchange-CrossTenant-originalarrivaltime: 23 Oct 2017 23:31:00.1375 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 6f56d3fa-5682-4261-b169-bc0d615da17c
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY4PR14MB1365
X-TM-AS-GCONF: 00
X-VPM-HOST: vmvpm02.z120.zixworks.com
X-VPM-GROUP-ID: f8ae9752-61e5-4e09-8866-6f8c695bbdac
X-VPM-MSG-ID: d68b120b-80f4-40ce-88be-504f228ff685
X-VPM-ENC-REGIME: Plaintext
X-VPM-IS-HYBRID: 0
Archived-At: <https://mailarchive.ietf.org/arch/msg/tls/SXt83Jq-l7stXKFTSaLqgdDiwAE>
Subject: Re: [TLS] Publication of draft-rhrd-tls-tls13-visibility-00
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 23 Oct 2017 23:31:06 -0000

NO
The objective is to be passively observe, out of band and not to be a MitM or modify/inject text.    Just as we all do today.  

-----Original Message-----
From: Benjamin Kaduk [mailto:bkaduk@akamai.com] 
Sent: Monday, October 23, 2017 6:33 PM
To: Ackermann, Michael <MAckermann@bcbsm.com>;; Tony Arcieri <bascule@gmail.com>;; Adam Caudill <adam@adamcaudill.com>;
Cc: tls@ietf.org
Subject: Re: [TLS] Publication of draft-rhrd-tls-tls13-visibility-00

On 10/23/2017 05:09 PM, Ackermann, Michael wrote:
> No one I am aware of is pushing for a MitM capability to address this.   
> In fact it was one of the alternative solutions for which many 
> implementation issues were cited at the Prague meeting and on this 
> list.    But I would like to ask,  what is the solution that your 
> company and others that you reference,  have solved this problem by 
> implementing?

Is not draft-rhrd-tls-tls13-visibility a MitM, in that the holder of the
SSWrapDH1 private key has the cryptographic capability to inject traffic and modify plaintext for the affected connections?

-Ben


The information contained in this communication is highly confidential and is intended solely for the use of the individual(s) to whom this communication is directed. If you are not the intended recipient, you are hereby notified that any viewing, copying, disclosure or distribution of this information is prohibited. Please notify the sender, by electronic mail or telephone, of any unintended receipt and delete the original message without making any copies.
 
 Blue Cross Blue Shield of Michigan and Blue Care Network of Michigan are nonprofit corporations and independent licensees of the Blue Cross and Blue Shield Association.