MIME-Version: 1.0
In-Reply-To: <CAHbuEH7aoiBK3vbH77Qdmiu6+ULS5VyefNydpkwM6MV=SmHdEA@mail.gmail.com>
References: <151800968634.4877.12510609339415982154.idtracker@ietfa.amsl.com>
 <CAHPuVdWO1LqNBK_f4xxcgP5PLQGDw1OMJiymf3jWXSDftP07+A@mail.gmail.com>
 <4c90bb83-5ba1-8193-df67-38e25f76caf8@nlnetlabs.nl>
 <CAHPuVdUVrzwNZDYktnztxuWQ-6yt+vT1aU76D1mL9rm3N3PJFw@mail.gmail.com>
 <CAHbuEH7aoiBK3vbH77Qdmiu6+ULS5VyefNydpkwM6MV=SmHdEA@mail.gmail.com>
From: Martin Thomson <martin.thomson@gmail.com>
Date: Wed, 14 Feb 2018 09:50:07 +1100
Message-ID: <CABkgnnXk7GNSHDZexSrryF6bepG3Zu5FZi6Nzi+gFxbh39-saw@mail.gmail.com>
To: Kathleen Moriarty <kathleen.moriarty.ietf@gmail.com>
Cc: Shumon Huque <shuque@gmail.com>,
 draft-ietf-tls-dnssec-chain-extension@ietf.org, The IESG <iesg@ietf.org>,
 =?UTF-8?Q?Mirja_K=C3=BChlewind?= <ietf@kuehlewind.net>, 
 tls-chairs <tls-chairs@ietf.org>, TLS WG <tls@ietf.org>
Content-Type: text/plain; charset="UTF-8"
Archived-At: <https://mailarchive.ietf.org/arch/msg/tls/cD_S6TAphgrfXTsMhSfnxWWWL48>
Subject: Re: [TLS] 
 =?utf-8?q?Mirja_K=C3=BChlewind=27s_No_Objection_on_draft-i?=
 =?utf-8?q?etf-tls-dnssec-chain-extension-06=3A_=28with_COMMENT=29?=
Precedence: list

On Wed, Feb 14, 2018 at 4:07 AM, Kathleen Moriarty
<kathleen.moriarty.ietf@gmail.com> wrote:
> What's the behavior when the middlebox is a proxy, let's say existing
> a managed network?  I presume from from section 3.1 that this
> negotiation doesn't work in that instance unless sites configured for
> this are not subject to the proxy as is often done for financial site
> access from corporate networks.  It would be good to know if it does
> work and that is addressed with the text Mirja calls out for her #1
> question.  Having this clarified could be helpful.

If there is a MitM, then this extension simply isn't negotiated.
That's pretty well understood.  I don't see why that requires special
mention.