Re: [TLS] draft-green-tls-static-dh-in-tls13-01

"Ackermann, Michael" <MAckermann@bcbsm.com> Sat, 08 July 2017 16:14 UTC

Return-Path: <mackermann@bcbsm.com>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E53EB129B94 for <tls@ietfa.amsl.com>; Sat, 8 Jul 2017 09:14:13 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -4.091
X-Spam-Level:
X-Spam-Status: No, score=-4.091 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, T_DKIM_INVALID=0.01] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=fail (1024-bit key) reason="fail (body has been altered)" header.d=bcbsm.onmicrosoft.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id evPNTAk-_wCU for <tls@ietfa.amsl.com>; Sat, 8 Jul 2017 09:14:12 -0700 (PDT)
Received: from mx.z120.zixworks.com (bcbsm.zixworks.com [199.30.235.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DB30F129B37 for <tls@ietf.org>; Sat, 8 Jul 2017 09:14:11 -0700 (PDT)
Received: from 127.0.0.1 (ZixVPM [127.0.0.1]) by Outbound.z120.zixworks.com (Proprietary) with SMTP id 46598C15B9 for <tls@ietf.org>; Sat, 8 Jul 2017 11:14:11 -0500 (CDT)
Received: from imsva1.bcbsm.com (unknown [12.107.172.80]) by mx.z120.zixworks.com (Proprietary) with SMTP id 2CEECC15B3; Sat, 8 Jul 2017 11:14:10 -0500 (CDT)
Received: from imsva1.bcbsm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id E013092069; Sat, 8 Jul 2017 12:14:09 -0400 (EDT)
Received: from imsva1.bcbsm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 9709492053; Sat, 8 Jul 2017 12:14:09 -0400 (EDT)
Received: from NAM03-BY2-obe.outbound.protection.outlook.com (unknown [216.32.180.50]) by imsva1.bcbsm.com (Postfix) with ESMTPS; Sat, 8 Jul 2017 12:14:09 -0400 (EDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=bcbsm.onmicrosoft.com; s=selector1-bcbsm-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=ArCepNYRIZuh1okYkGy8aiJ9qIL+/FaIelawHHzTnKo=; b=dWbawZNvNkrSTKLckhqNj4jfN1f+vC1b2O+2Lu9VgVY1ZLQtxpKBjy2MTHSXUhn38qz5NxbxQ39XoPWO/tGX+vSWLvpEshzpNbtvI0D1W38Mzw3lDjJEM2UdEGrS5k1zynpx7Z/ndqUGLtB/0kH1TEpYx4+4VV8+hqM39yc9NLo=
Received: from CY4PR14MB1368.namprd14.prod.outlook.com (10.172.158.148) by CY4PR14MB1367.namprd14.prod.outlook.com (10.172.158.147) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1240.13; Sat, 8 Jul 2017 16:14:07 +0000
Received: from CY4PR14MB1368.namprd14.prod.outlook.com ([10.172.158.148]) by CY4PR14MB1368.namprd14.prod.outlook.com ([10.172.158.148]) with mapi id 15.01.1240.013; Sat, 8 Jul 2017 16:14:07 +0000
From: "Ackermann, Michael" <MAckermann@bcbsm.com>
To: Yoav Nir <ynir.ietf@gmail.com>, Timothy Jackson <tjackson@mobileiron.com>
CC: Watson Ladd <watsonbladd@gmail.com>, Christian Huitema <huitema@huitema.net>, "tls@ietf.org" <tls@ietf.org>
Thread-Topic: [TLS] draft-green-tls-static-dh-in-tls13-01
Thread-Index: AQHS9u8RCuLDt7dBiEuHKxJZjnlNtqJIVJcAgAA7lACAAB2RAIAABXEAgAABDQCAABZYAIAABAWAgAAPEACAAAECAIAABj8AgAACzgCAAAGCAIAANuiAgAAIJQCAAASV8IAAFxiAgACb0ACAACyt8A==
Date: Sat, 08 Jul 2017 16:13:47 +0000
Deferred-Delivery: Sat, 8 Jul 2017 16:12:00 +0000
Message-ID: <CY4PR14MB13680AE2D7AED629EDBA6B5AD7AB0@CY4PR14MB1368.namprd14.prod.outlook.com>
References: <CAPCANN-xgf3auqy+pFfL6VO5GpEsCCHYkROAwiB1u=8a4yj+Fg@mail.gmail.com> <CAL02cgRJeauV9NQ2OrGK1ocQtg-M2tbWm2+5HUc4-Wc8KC3vxQ@mail.gmail.com> <71E07F32-230F-447C-B85B-9B3B4146D386@vigilsec.com> <39bad3e9-2e17-30f6-48a7-a035d449dce7@cs.tcd.ie> <CAJU8_nXBFkpncFDy4QFnd6hFpC7oOZn-F1-EuBC2vk3Y6QKq3A@mail.gmail.com> <f0554055-cdd3-a78c-8ab1-e84f9b624fda@cs.tcd.ie> <A0BEC2E3-8CF5-433D-BA77-E8474A2C922A@vigilsec.com> <658a6b50-54a7-600a-2f6a-480daf2321dc@cs.tcd.ie> <F830F0DA-F3F1-4A61-8B42-100D31E6F831@vigilsec.com> <1ebb85c3-842e-36f6-ccd5-da7074342118@cs.tcd.ie> <E639C60A-D90C-46C2-9A18-5D02D6EBD9E4@vigilsec.com> <d16833ed-3b6b-3685-e109-1673f69c67a5@cs.tcd.ie> <5CF364CB-96E1-4103-9C83-81187897F5F3@vigilsec.com> <4f733022-dabb-53a2-2eb7-425134c137f8@huitema.net> <CACsn0ck8P0Dn3L_tmVmmAez=xo0hmFxQEqkfqw+O7ZzcHpwtTw@mail.gmail.com> <CY4PR14MB13689ABCC728747E9B999AEFD7AB0@CY4PR14MB1368.namprd14.prod.outlook.com> <kokbii6v34dsk060vpa2if7u.1499483924916@emailplus.mobileiron.com> <B63E3C2C-CA56-442B-829A-9A9985235D1D@gmail.com>
In-Reply-To: <B63E3C2C-CA56-442B-829A-9A9985235D1D@gmail.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
authentication-results: gmail.com; dkim=none (message not signed) header.d=none;gmail.com; dmarc=none action=none header.from=bcbsm.com;
x-originating-ip: [165.225.0.71]
x-ms-publictraffictype: Email
x-microsoft-exchange-diagnostics: 1; CY4PR14MB1367; 20:8w+sW7/eyZXttIvrjO9OMM4IAYVLdpehEyt3133jlDH2cHRWJFc6jMC6MPE44Hn1y9MZw64KIYwcJ6Kem9+6XPUe9HlRJQBQ8IgV/9U+S1RwAEwnZyxW5Fv+O8J93Cpm7jjSQ5IiLW6/DBI5AeCtA6dHk9mP1j/UBj17WCZXQ20=
x-ms-office365-filtering-correlation-id: c924784b-ca9b-43f3-f545-08d4c61c5c68
x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(300000500095)(300135000095)(300000501095)(300135300095)(22001)(300000502095)(300135100095)(2017030254075)(300000503095)(300135400095)(2017052603031)(201703131423075)(201703031133081)(201702281549075)(300000504095)(300135200095)(300000505095)(300135600095)(300000506095)(300135500095); SRVR:CY4PR14MB1367;
x-ms-traffictypediagnostic: CY4PR14MB1367:
x-microsoft-antispam-prvs: <CY4PR14MB13674645E4655F98C52AF696D7AB0@CY4PR14MB1367.namprd14.prod.outlook.com>
x-exchange-antispam-report-test: UriScan:(151999592597050)(26388249023172)(236129657087228)(148574349560750)(142563422833929)(21748063052155)(86572411397741)(266576461109395)(247924648384137);
x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(100000700101)(100105000095)(100000701101)(100105300095)(100000702101)(100105100095)(6040450)(601004)(2401047)(5005006)(2017060910075)(8121501046)(100000703101)(100105400095)(93006095)(93001095)(3002001)(10201501046)(6041248)(20161123560025)(201703131423075)(201702281528075)(201703061421075)(201703061406153)(20161123555025)(20161123564025)(20161123558100)(20161123562025)(6072148)(100000704101)(100105200095)(100000705101)(100105500095); SRVR:CY4PR14MB1367; BCL:0; PCL:0; RULEID:(100000800101)(100110000095)(100000801101)(100110300095)(100000802101)(100110100095)(100000803101)(100110400095)(100000804101)(100110200095)(100000805101)(100110500095); SRVR:CY4PR14MB1367;
x-forefront-prvs: 0362BF9FDB
x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(39410400002)(39400400002)(39450400003)(39840400002)(24454002)(377454003)(6506006)(80792005)(33656002)(7696004)(74316002)(53546010)(6666003)(6436002)(2950100002)(230783001)(19609705001)(93886004)(2906002)(4326008)(77096006)(229853002)(76176999)(54356999)(50986999)(5660300001)(3280700002)(72206003)(99286003)(66066001)(189998001)(3660700001)(55016002)(8936002)(54906002)(236005)(102836003)(6116002)(790700001)(53936002)(6246003)(3846002)(14454004)(81166006)(8676002)(478600001)(38730400002)(2900100001)(25786009)(7736002)(39060400002)(86362001)(6306002)(54896002)(9686003); DIR:OUT; SFP:1102; SCL:1; SRVR:CY4PR14MB1367; H:CY4PR14MB1368.namprd14.prod.outlook.com; FPR:; SPF:None; MLV:ovrnspm; PTR:InfoNoRecords; LANG:en;
spamdiagnosticoutput: 1:99
spamdiagnosticmetadata: NSPM
Content-Type: multipart/alternative; boundary="_000_CY4PR14MB13680AE2D7AED629EDBA6B5AD7AB0CY4PR14MB1368namp_"
MIME-Version: 1.0
X-OriginatorOrg: bcbsm.com
X-MS-Exchange-CrossTenant-originalarrivaltime: 08 Jul 2017 16:14:07.6755 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 6f56d3fa-5682-4261-b169-bc0d615da17c
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY4PR14MB1367
X-TM-AS-GCONF: 00
X-VPM-HOST: vmvpm02.z120.zixworks.com
X-VPM-GROUP-ID: c448b08b-441e-4281-b7f4-aff44167a944
X-VPM-MSG-ID: 8d86788a-3dd1-420b-a039-69305758bb8c
X-VPM-ENC-REGIME: Plaintext
X-VPM-IS-HYBRID: 0
Archived-At: <https://mailarchive.ietf.org/arch/msg/tls/_7h7Gh5VtyZQ3D4k5vfgqrqacdg>
Subject: Re: [TLS] draft-green-tls-static-dh-in-tls13-01
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sat, 08 Jul 2017 16:14:14 -0000

+1

From: Yoav Nir [mailto:ynir.ietf@gmail.com]
Sent: Saturday, July 8, 2017 8:36 AM
To: Timothy Jackson <tjackson@mobileiron.com>
Cc: Ackermann, Michael <MAckermann@bcbsm.com>; Watson Ladd <watsonbladd@gmail.com>; Christian Huitema <huitema@huitema.net>; tls@ietf.org
Subject: Re: [TLS] draft-green-tls-static-dh-in-tls13-01


On 8 Jul 2017, at 6:18, Timothy Jackson <tjackson@mobileiron.com<mailto:tjackson@mobileiron.com>> wrote:

As an earlier poster asked, what advantage does this approach have over TLS-inspecting proxies? Every IPS/IDS/next gen firewall with which I am familiar is able to terminate at TLS connection, inspect/copy/filter, and then encrypt on a new TLS sessions.

For high performance customers, the SSL accelerators can be sandwiched around the filter so all the crypto is done in hardware.

The ways to prevent TLS inspection are cert pinning and client cert auth. If this is only within one's data center, then those features can be disabled if necessary, no?

What use case am I missing that can't be achieved better by other means than static keys?

They would like to store traffic captures encrypted and be able to decrypt them a little later if that is necessary. Storing plaintext is something that auditors (rightfully!) don't like.

They also don't want to install TLS proxies all over the place.  That's a large extra expense for them.

Yoav



The information contained in this communication is highly confidential and is intended solely for the use of the individual(s) to whom this communication is directed. If you are not the intended recipient, you are hereby notified that any viewing, copying, disclosure or distribution of this information is prohibited. Please notify the sender, by electronic mail or telephone, of any unintended receipt and delete the original message without making any copies.
 
 Blue Cross Blue Shield of Michigan and Blue Care Network of Michigan are nonprofit corporations and independent licensees of the Blue Cross and Blue Shield Association.