Re: [TLS] Publication of draft-rhrd-tls-tls13-visibility-00

"David A. Cooper" <> Tue, 24 October 2017 20:40 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 954731390EE for <>; Tue, 24 Oct 2017 13:40:59 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -2.455
X-Spam-Status: No, score=-2.455 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, MIME_HTML_ONLY=0.723, MISSING_HEADERS=1.021, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id gCr-h5wK6O2j for <>; Tue, 24 Oct 2017 13:40:57 -0700 (PDT)
Received: from ( [IPv6:2610:20:6005:13::150]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by (Postfix) with ESMTPS id 989EA13A102 for <>; Tue, 24 Oct 2017 13:40:57 -0700 (PDT)
Received: from ( by ( with Microsoft SMTP Server (TLS) id 14.3.361.1; Tue, 24 Oct 2017 16:42:20 -0400
Received: from ( by ( with Microsoft SMTP Server id 14.3.361.1; Tue, 24 Oct 2017 16:40:55 -0400
Received: from [] ( []) by (8.13.8/8.13.1) with ESMTP id v9OKeVvh019578 for <>; Tue, 24 Oct 2017 16:40:32 -0400
CC: "" <>
References: <> <> <> <> <> <> <> <> <>
From: "David A. Cooper" <>
Message-ID: <>
Date: Tue, 24 Oct 2017 16:40:38 -0400
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.4.0
MIME-Version: 1.0
In-Reply-To: <>
Content-Type: text/html; charset="windows-1252"
Content-Language: en-US
Content-Transfer-Encoding: 7bit
Archived-At: <>
Subject: Re: [TLS] Publication of draft-rhrd-tls-tls13-visibility-00
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Tue, 24 Oct 2017 20:40:59 -0000

On 10/24/2017 04:24 PM, Ted Lemon wrote:
On Oct 24, 2017, at 4:21 PM, David A. Cooper <> wrote:
I'm not suggesting that cash strapped schools would use one of these devices. I'm simply saying that such a solution would be simpler and far more effective than trying to use draft-rhrd-tls-tls13-visibility to snoop on outgoing traffic.

Again, if that were true, then it would also be true that these devices would nicely solve the problem that draft-rhrd-tls-tls13-visibility solves.

Not at all. Visibility in the data center is a totally different problem than inspecting outgoing traffic. In the data center case the same organization controls the clients, servers, and the authorized listeners. That is very different from a scenario in which the organization that wants to listen in is different from the organizations that control the servers, and in which the organizations that control the servers are unlikely to want to grant this intermediary the ability to listen in on the traffic between it and its clients.

Also, in the data center case, there is no middlebox. Others, who know much more than I do about operational constraints in data center environments, have already argued that setting up a bunch of middleboxes would not be a viable solution.