IETF Logo Mail Archive

[TLS] Re: Additional uses for SSLKEYLOGFILE entries

S Moonesamy <sm+ietf@elandsys.com> Thu, 27 February 2025 21:01 UTC

Return-Path: <sm@elandsys.com>
X-Original-To: tls@mail2.ietf.org
Delivered-To: tls@mail2.ietf.org
Received: from localhost (localhost [127.0.0.1]) by mail2.ietf.org (Postfix) with ESMTP id 5F67932B05B for <tls@mail2.ietf.org>; Thu, 27 Feb 2025 13:01:05 -0800 (PST)
X-Virus-Scanned: amavisd-new at ietf.org
X-Spam-Flag: NO
X-Spam-Score: -1.7
X-Spam-Level:
X-Spam-Status: No, score=-1.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_INVALID=0.1, DKIM_SIGNED=0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=no autolearn_force=no
Authentication-Results: mail2.ietf.org (amavisd-new); dkim=fail (1024-bit key) reason="fail (message has been altered)" header.d=elandsys.com
Received: from mail2.ietf.org ([166.84.6.31]) by localhost (mail2.ietf.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id sEBC9PCFeN6R for <tls@mail2.ietf.org>; Thu, 27 Feb 2025 13:01:03 -0800 (PST)
Received: from mx.ipv6.elandsys.com (mx.ipv6.elandsys.com [IPv6:2001:470:f329:1::1]) by mail2.ietf.org (Postfix) with ESMTP id 34B3E32B03A for <tls@ietf.org>; Thu, 27 Feb 2025 13:01:03 -0800 (PST)
Received: from DESKTOP-K6V9C2L.elandsys.com ([102.117.48.107]) (authenticated bits=0) by mx.elandsys.com (8.15.2/8.14.5) with ESMTPSA id 51RL0j7j024536 (version=TLSv1 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Thu, 27 Feb 2025 13:00:55 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=elandsys.com; s=mail; t=1740690057; x=1740776457; i=@elandsys.com; bh=Y8VocqIkyJ8r0eTPr+uktqMvr483IScqhKqXS8XlZQI=; h=Date:To:From:Subject:In-Reply-To:References; b=mEjQbKFkbY+U90p4QyGTU6Rf6LleX4cyF+xzcknCJKccOBTnJU1iTH7I8QIWJrEMW K8pvf9HFUsNZZwOiH90lrXgmeZamlMVlaNwiK1EQf6XIfOKuOMnv1SFC7rO6T2DWW2 pFHWQL3em7+grAnOLm0AZgF0oZfMvmD1KjZf8Jr8=
Message-Id: <6.2.5.6.2.20250227125149.0e922120@elandnews.com>
X-Mailer: QUALCOMM Windows Eudora Version 6.2.5.6
Date: Thu, 27 Feb 2025 12:59:56 -0800
To: Stephen Farrell <stephen.farrell@cs.tcd.ie>, "Sipos, Brian J." <Brian.Sipos@jhuapl.edu>, tls@ietf.org
From: S Moonesamy <sm+ietf@elandsys.com>
In-Reply-To: <c56b7f35-9e27-438c-8614-fbef23a024b4@cs.tcd.ie>
References: <f49006e2f9d24cf8ba855b29d7bea925@jhuapl.edu> <c56b7f35-9e27-438c-8614-fbef23a024b4@cs.tcd.ie>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"; format="flowed"
Message-ID-Hash: C435VIDBNBD7YFTSEJUZGUBKFKYH3EUI
X-Message-ID-Hash: C435VIDBNBD7YFTSEJUZGUBKFKYH3EUI
X-MailFrom: sm@elandsys.com
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-tls.ietf.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
X-Mailman-Version: 3.3.9rc6
Precedence: list
Subject: [TLS] Re: Additional uses for SSLKEYLOGFILE entries
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/tls/dXiYFBA1wjG845aikzLEQXsRW7I>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Owner: <mailto:tls-owner@ietf.org>
List-Post: <mailto:tls@ietf.org>
List-Subscribe: <mailto:tls-join@ietf.org>
List-Unsubscribe: <mailto:tls-leave@ietf.org>

Hi Brian, Stephen,
At 06:18 AM 27-02-2025, Stephen Farrell wrote:
> From my POV yes: fundamentally it is a bad idea for
>the IETF to standardise ways to exfiltrate keys
>even if there may be innocuous uses for those. And
>this latest ask (extending the exfiltration from
>being a TLS-only thing, to cover other protocols
>such as EDHOC) IMO nicely demonstrates the danger
>of the TLS WG publishing this document.

According to Sheffer, Holz and Saint-Andre, "It is known that stolen 
(or otherwise obtained) private keys have been used as part of 
large-scale monitoring [RFC7258] of certain servers."

Regards,
S. Moonesamy

v2.31.3 | Report a Bug | By Email | System Status