Re: [TLS] The risk of misconfiguration

On Tue, May 6, 2014 at 8:59 PM, Viktor Dukhovni
<viktor1dane@dukhovni.org> wrote:
> On Tue, May 06, 2014 at 08:32:43PM -0700, Watson Ladd wrote:
>
>> > In Postfix the user chooses a "cipher-grade" that sets the floor
>> > on the set of enabled cipher-suites.  The levels are monotone.
>> > This is a simple interface that is rather difficult to mess up.
>>
>> Actually, it makes the same mistake as OpenSSL does:enabling anonymous
>> ciphers even when configured to send a server certificate and use 128
>> bit encryption, without an additional option set. (Source:
>> http://www.postfix.org/TLS_README.html, search for the Server-Side
>> Cipher Controls section)
>
> What you say is mistake in Postfix is actually a mistake in your
> problem analysis.
>
> http://tools.ietf.org/html/draft-ietf-dane-smtp-with-dane-09#section-8.2
>
> use of anonymous ciphers in Postfix is not an accident, it is rather
> deliberate.
>
>> Of course, the sad state of TLS for email prevents this from being a
>> problem in practice.
>
> Actually TLS for email is not in such sorry shape as you might
> think.  I bet a larger share of SMTP traffic is encrypted than with
> HTTP.  Opportunistic TLS has a simpler deployment model.
>

Go walk outside. Ask someone "When you send email to someone, who can
read it?". Compare their answer to the reality. So long as there is a
difference between those two, you have a problem. At least with the
web, we have a (somewhat) functioning PKI, and it's the protocol and
implementations that are the real problem.

(Interestingly DKIM ensures all email is signed, even without DANE,
yet we've not been able to turn that into encrypting the connections
between mail servers in 9 years of work. XMPP has a flag day in 13
days in which encryption will be on. Most servers will be using
certificates.)

Furthermore, in TLS 1.3 we've made changes to the protocol that have
the side effect of removing everything but AES and Camellia. Yes, if
you want to saturate a gigabit Ethernet cable using a 1.3 GHz
processor, you may have a problem with encryption slowing things down.
Is that worth the hazard null encryption presents? I'm not sure: I
agree that (some) of the misconfiguration hazards are a result of the
deplorable state of a major implementation, that is going to get
massively changed, and so maybe we shouldn't worry too much. On the
other hand people have turned them on by accident.

Sincerely,
Watson Ladd
>
> --
>         Viktor.
>
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls

-- 
"Those who would give up Essential Liberty to purchase a little
Temporary Safety deserve neither  Liberty nor Safety."
-- Benjamin Franklin