Re: [TLS] TLS Proxy Server Extension

[Philip Gladstone <[e-mail]>]

On 8/3/2011 8:18 AM, Ken Peirce wrote:
> The TLS proxy exists today. It's two sessions in relay mode. The end user accepts the peer of the first session to be a trusted entity. If this trust is misplaced, that has nothing to do with the protocol.

This is exactly true. The problem that we are trying to solve is to find 
out the actual identity of the server that the proxy has connected to. 
Further, we want the client to be able to validate the certificate of 
the server according to its own rules (which may include a different 
list of trusted root certificates). As people have pointed out, being 
able to understand the EV status of the remote server could be important.

I think, based on the discussion, that there is a place for a new type 
of object in the TLS model -- the read-only proxy. This would require 
significant changes to the TLS protocol to support, and it might be 
significantly more difficult to implement than the current two TLS 
session approach. However, I suspect that until all proxies supported 
this new protocol, they would have to support the two TLS session model 
as well -- a viable strategy might be to try and negotiate the read-only 
proxy protocol and then fall back to the two TLS session model.

Philip

-- 
Philip Gladstone
Phone: +1 978-ZEN-TOAD ([phone])
Ham radio: N1DQ