Re: [TLS] TLS Proxy Server Extension

[Ken Peirce <[e-mail]>]

Yoav,

> The use-case that interests me is deep firewall inspection.
> HTTP connections are routinely inspected by firewalls for
> downloaded malware, cross-site scripting, and various other
> attacks. Without a TLS proxy, HTTPS connections can either
> slip under the radar or get blocked entirely. That would
> have been fine a few years ago, when SSL was only used for
> shopping and banking sites (you could defer your shopping
> and banking for when you were home). These days the use of
> HTTPS is becoming more prevalent, so blocking HTTPS is no
> longer a good option. A TLS proxy allows an organization to
> use HTTPS while still applying company policy and defenses.


Why would you want to make banking and shopping less secure to support these other usage scenarios? The law enforcement community and service providers spend a lot of money to manage the security of their interception tools. There are many recorded cases where control of these tools was mishandled and abused by another party. TLS takes the human being out of the equation and protects the end user with known mathematical barriers. The TLS proxy exists today. It's two sessions in relay mode. The end user accepts the peer of the first session to be a trusted entity. If this trust is misplaced, that has nothing to do with the protocol. This is an application layer problem. 

Please ask the IETF leadership to form a new working group for a new protocol with this proxy as a fundamental tenet. You can experiment with this new protocol all you want. I do not want to see TLS broken because of tinkering in the name of some unestablished need. 

Ken