Re: [TLS] chairs - please shutdown wiretapping discussion...

[Russ Housley <[e-mail]>]

Tony:

I want to highlight that draft-green-tls-static-dh-in-tls13-01 does not enable MitM.  The server does not share the signing private key, so no other party can perform a valid handshake.  Further, the server is choosing to use a (EC)DH key that was generated by the key manager, so it is quite different than the mandatory key escrow used in the Clipper Chip.

Russ


> On Jul 8, 2017, at 11:39 AM, Tony Arcieri <[e-mail]> wrote:
> 
> I was one of the people arguing my hardest against the BITS Security proposal to continue to (ab)use RSA static keys to allow passive MitM, even though TLS 1.3 had already moved forward on what I would call a more modern protocol design of the sort I believe payments companies should embrace to improve their security.
> 
> That said, if people do want to MitM themselves, I would rather there be a single, easily detectable and very explicit way of doing so, as opposed to sketchy, incompatible, ad hoc mechanisms. Furthermore, it would be nice to have a clear answer for these users, less they continue to make (bad) arguments that there is something fundamentally wrong with the design of TLS 1.3 that makes it incompatible with "industry requirements".
> 
> Clearly there are echoes of the scary protocols of yesteryear, i.e. Clipper/LEAP. I think if you visit Matt Green's Twitter page and check the image header you will discover he is quite familiar with these things, and my personal presumption would be he is not displaying this image to show his undying love of the Clipper chip, although perhaps he's an especially crafty and duplicitous NSA sleeper agent.