IETF Logo Mail Archive

Re: [TLS] Industry Concerns about TLS 1.3

BITS Security <BITSSecurity@fsroundtable.org> Fri, 23 September 2016 21:10 UTC

Return-Path: <BITSSecurity@fsroundtable.org>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 98C4E12B5BC for <tls@ietfa.amsl.com>; Fri, 23 Sep 2016 14:10:34 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.921
X-Spam-Level:
X-Spam-Status: No, score=-1.921 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=fsroundtable.onmicrosoft.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gBe8eYRLOu6P for <tls@ietfa.amsl.com>; Fri, 23 Sep 2016 14:10:32 -0700 (PDT)
Received: from NAM01-BY2-obe.outbound.protection.outlook.com (mail-by2nam01on0061.outbound.protection.outlook.com [104.47.34.61]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AF2FE12B58D for <tls@ietf.org>; Fri, 23 Sep 2016 14:10:32 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fsroundtable.onmicrosoft.com; s=selector1-fsroundtable-org; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=wKeSSqCgk97tGQxhh1LoZSV8JR0EebspoQ7trYSp1EY=; b=AAe469EmKtPc5duySfExCv58GmXJ5E9ZSQl3d44nJ1DLNTSywJy3FzYO1zvU8jPEIHXWsGwvhyglXoN6ltu4kt+RKTNGqEjH/UH+te/fzwhutq8JQ5diR7re/g1T4fCZcCw7kZoJN7bI8nL2+Kb+kz9a8p1PjIJePD0hNRm7BT8=
Received: from DM5PR11MB1419.namprd11.prod.outlook.com (10.168.104.21) by DM5PR11MB1418.namprd11.prod.outlook.com (10.168.104.20) with Microsoft SMTP Server (version=TLS1_0, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA_P384) id 15.1.619.10; Fri, 23 Sep 2016 21:10:31 +0000
Received: from DM5PR11MB1419.namprd11.prod.outlook.com ([10.168.104.21]) by DM5PR11MB1419.namprd11.prod.outlook.com ([10.168.104.21]) with mapi id 15.01.0619.011; Fri, 23 Sep 2016 21:10:31 +0000
From: BITS Security <BITSSecurity@fsroundtable.org>
To: Yaron Sheffer <yaronf.ietf@gmail.com>
Thread-Topic: [TLS] Industry Concerns about TLS 1.3
Thread-Index: AdIU8WqWM9WBapZoQzyfqxiOaK25fQADrwVgABxJhIAADgIdgAAAS/+AAAFEjIAAAGtwAAAHxtLQAADiU4AAAeJj0A==
Date: Fri, 23 Sep 2016 21:10:31 +0000
Message-ID: <DM5PR11MB1419F8F0D0C80835C1DB49F2F4C80@DM5PR11MB1419.namprd11.prod.outlook.com>
References: <DM5PR11MB1419B782D2BEF0E0A35E420DF4C90@DM5PR11MB1419.namprd11.prod.outlook.com> <CO1PR07MB283F2C414B6478E993675DEC3C90@CO1PR07MB283.namprd07.prod.outlook.com> <394611bf-208f-03d3-620c-79aaf169645b@cs.tcd.ie> <4FC37E442D05A748896589E468752CAA0DBC66AE@PWN401EA120.ent.corp.bcbsm.com> <CAH8yC8kgYzYXwJ01NkK7WYxD-diponWEQOd+MNHssm+bLHE54w@mail.gmail.com> <4FC37E442D05A748896589E468752CAA0DBC699B@PWN401EA120.ent.corp.bcbsm.com> <CACsn0c=5vjzQmr=ah6sH1JzTj3peaKad7aCPertcqD4B2DLKiA@mail.gmail.com> <DM5PR11MB141941D8E156245A1CF6C911F4C80@DM5PR11MB1419.namprd11.prod.outlook.com> <126ee1b6-fc88-bf4e-c366-60d59a9b3350@gmail.com>
In-Reply-To: <126ee1b6-fc88-bf4e-c366-60d59a9b3350@gmail.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
authentication-results: spf=none (sender IP is ) smtp.mailfrom=BITSSecurity@fsroundtable.org;
x-ms-exchange-messagesentrepresentingtype: 1
x-originating-ip: [165.117.248.226]
x-ms-office365-filtering-correlation-id: 996c5afe-1640-494f-eb64-08d3e3f60d64
x-microsoft-exchange-diagnostics: 1; DM5PR11MB1418; 6:GRNddXcorMdy6WOEEiBoXQ5OES+jIwHVOHMsWyzX2H9h7IBIjqCzDC/cL9N246+rLeCs2OHFjtHYmZ3ihjhvsBfGbxgeFvGmQbXV5Vd0cfrF5pZHQQYrxBpimjxZ+aAy03JztdQGYf4m5FXTG2TLjNjYQb4+In5axVL6NiAufYirOwPuZpwv49+zFnWtaThusGYmvT7bY83SQsTOLttyztF7DKabw2UyCZQh8imElAc3H1232h5qk4zY0PmKrjbzLEKebwnPBizUlvdYNMA1IiwADa9IbjyFFLaqH2gQsjYs8Op+a5jZOSVtmv50xafi; 5:7eRnt3ADBfivoQ8ntsQU0JTZM6aD1nfL2swx+XoZApec+Vkx5ccK1V7y8UwgjXtDfaQNd9RFBim/J8o2NXoBHmNlW8MifLwOnpCwA67ttPSOFlz5sCB579nPBjcN2QwDpf2TuHfEucjR6YQEHDB8Hw==; 24:4J9XRfgNxK8jTqn3YvZs7lnfRx46Vwfgdap0w+/917j+n8Sx3xd+O46D9gBUOm9KYoI3HVRTFj734zbntHL5KeOeiWIK41hxRqTc6vpvaUA=; 7:xktqjoEfnPE3gnylylpXZpn2F6xz+7ZIqO/hViPO04LTGNLWDfLaH1zsVrKAJ5K+dIFSi77fwQPt1X/PYuHChP/AE20wiq3l/K6i2waLDSvfHja2VhnI/4YEzuR9JrgA4ooyt5BTyrCvHEjdUtcut0h5hFVw8c1nKMZfGJ5gqTKNy4OkHM8d2HMJcoTqEjQKOQtgdn+NOaxBsMFl0gafw4+te5zo6Q9re8oMRLrZj0CCdOgSGUeN18FO6KWbDd1l0Dsmv6itHwRNFHHolWpFquwQcXvk++OSX5xMYmH7UE+Ko9adx8IdXCDSeVD4j492
x-microsoft-antispam: UriScan:;BCL:0;PCL:0;RULEID:;SRVR:DM5PR11MB1418;
x-microsoft-antispam-prvs: <DM5PR11MB1418A65C886A660FE8F3476BBDC80@DM5PR11MB1418.namprd11.prod.outlook.com>
x-exchange-antispam-report-test: UriScan:(192374486261705)(86572411397741)(266576461109395);
x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(6040176)(601004)(2401047)(5005006)(8121501046)(10201501046)(3002001)(6043046)(6042046); SRVR:DM5PR11MB1418; BCL:0; PCL:0; RULEID:; SRVR:DM5PR11MB1418;
x-forefront-prvs: 0074BBE012
x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(979002)(6009001)(7916002)(189002)(13464003)(377454003)(199003)(3280700002)(11100500001)(74316002)(10400500002)(305945005)(97736004)(110136003)(5002640100001)(80792005)(76176999)(50986999)(122556002)(86362001)(7696004)(54356999)(6916009)(2950100002)(5660300001)(8676002)(105586002)(2900100001)(93886004)(189998001)(9686002)(66066001)(33656002)(8936002)(586003)(19580405001)(68736007)(2906002)(102836003)(81166006)(101416001)(87936001)(99286002)(19580395003)(6116002)(7846002)(77096005)(7736002)(81156014)(106356001)(4326007)(92566002)(3846002)(3660700001)(76576001)(969003)(989001)(999001)(1009001)(1019001); DIR:OUT; SFP:1101; SCL:1; SRVR:DM5PR11MB1418; H:DM5PR11MB1419.namprd11.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; MX:1; A:1; LANG:en;
received-spf: None (protection.outlook.com: fsroundtable.org does not designate permitted sender hosts)
spamdiagnosticoutput: 1:99
spamdiagnosticmetadata: NSPM
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: base64
MIME-Version: 1.0
X-OriginatorOrg: fsroundtable.org
X-MS-Exchange-CrossTenant-originalarrivaltime: 23 Sep 2016 21:10:31.3467 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 841de5a0-73e8-4cbc-8142-f80b225ef22d
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM5PR11MB1418
Archived-At: <https://mailarchive.ietf.org/arch/msg/tls/_h8Wl_vuAjLumAdNpT7C1eJIoHg>
Cc: "tls@ietf.org" <tls@ietf.org>
Subject: Re: [TLS] Industry Concerns about TLS 1.3
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.17
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 23 Sep 2016 21:10:34 -0000

It's possible to run TLS 1.3 and PFS through the Content Delivery Network and into the enterprise data center, and then have a load balancer or other proxy terminate TLS.  This gives us the option of running a different protocol in the data center, but we need a better option than TLS 1.2 that will, perhaps sooner than we might expect, be deprecated.  

-Andrew 

-----Original Message-----
From: Yaron Sheffer [mailto:yaronf.ietf@gmail.com] 
Sent: Friday, September 23, 2016 3:52 PM
To: BITS Security <BITSSecurity@fsroundtable.org>; Watson Ladd <watsonbladd@gmail.com>; Ackermann, Michael <MAckermann@bcbsm.com>
Cc: tls@ietf.org
Subject: Re: [TLS] Industry Concerns about TLS 1.3

You are implicitly suggesting to remove perfect-forward-secrecy as soon as a TLS flow is created by the CDN. However these packets will still be traveling over the public Internet and/or "private" (leased, not really
private) MPLS VPNs, where we KNOW that government agencies are eavesdropping and recording network flows to keep for years ahead. In other words, even when the TLS flow enters "your" network, you and your customer are still at risk from pervasive monitoring.

Thanks,
	Yaron

v2.23.0 | Report a Bug | By Email