Re: [TLS] network-based security solution use cases

Flemming Andreasen <fandreas@cisco.com> Tue, 07 November 2017 02:47 UTC

Return-Path: <fandreas@cisco.com>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AD9F713FB5D for <tls@ietfa.amsl.com>; Mon, 6 Nov 2017 18:47:49 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -14.52
X-Spam-Level:
X-Spam-Status: No, score=-14.52 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 426tGvPiqhW9 for <tls@ietfa.amsl.com>; Mon, 6 Nov 2017 18:47:48 -0800 (PST)
Received: from rcdn-iport-7.cisco.com (rcdn-iport-7.cisco.com [173.37.86.78]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0F5B213FB0D for <tls@ietf.org>; Mon, 6 Nov 2017 18:47:48 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=2482; q=dns/txt; s=iport; t=1510022868; x=1511232468; h=subject:to:cc:references:from:message-id:date: mime-version:in-reply-to:content-transfer-encoding; bh=JpwbW0L+q5Qb179qjnMZDfuoPHYDYXktBieUnvRpc1E=; b=eaJvnEkKnYpWDm50ERAtmXNl7vxYmlgRg18fTimyc18drALogLamWBVx 6qDX2qPLB7JPks+HoAiG0XVJb6iNqc1ZeCsYdqjc9OqWhQPHNBDOvK90f twolwKVP4QKd3kTdoR7gVnnsA3yCl3nW1FxtHqwVNCGKzT0q+GH+Nb1z0 8=;
X-IronPort-AV: E=Sophos;i="5.44,355,1505779200"; d="scan'208";a="315452544"
Received: from alln-core-12.cisco.com ([173.36.13.134]) by rcdn-iport-7.cisco.com with ESMTP/TLS/DHE-RSA-AES256-SHA; 07 Nov 2017 02:47:47 +0000
Received: from [10.118.10.19] (rtp-fandreas-2-8812.cisco.com [10.118.10.19]) by alln-core-12.cisco.com (8.14.5/8.14.5) with ESMTP id vA72lktd013999; Tue, 7 Nov 2017 02:47:47 GMT
To: Florian Weimer <fw@deneb.enyo.de>, "Nancy Cam-Winget (ncamwing)" <ncamwing@cisco.com>
Cc: "tls@ietf.org" <tls@ietf.org>
References: <895D1206-28D1-43AB-8A45-11DEEC86A71D@cisco.com> <874lq868t3.fsf@mid.deneb.enyo.de>
From: Flemming Andreasen <fandreas@cisco.com>
Message-ID: <a7a78674-d80d-dbd3-3c65-2d4000922423@cisco.com>
Date: Mon, 6 Nov 2017 21:48:38 -0500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:52.0) Gecko/20100101 Thunderbird/52.4.0
MIME-Version: 1.0
In-Reply-To: <874lq868t3.fsf@mid.deneb.enyo.de>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 8bit
Content-Language: en-US
Archived-At: <https://mailarchive.ietf.org/arch/msg/tls/gI0p_Mhntl_PVkf5c3tMMGo64zE>
Subject: Re: [TLS] network-based security solution use cases
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 07 Nov 2017 02:47:50 -0000


On 11/5/17 10:31 AM, Florian Weimer wrote:
> * Nancy Cam-Winget:
>
>> @IETF99, awareness was raised to some of the security WGs (thanks
>> Kathleen ☺) that TLS 1.3 will obscure visibility currently afforded in
>> TLS 1.2 and asked what the implications would be for the security
>> solutions today.
>> https://tools.ietf.org/html/draft-camwinget-tls-use-cases-00 is an
>> initial draft to describe some of the impacts relating to current
>> network security solutions.  The goal of the draft is NOT to propose
>> any solution as a few have been proposed, but rather to raise
>> awareness to how current network-based security solutions work today
>> and their impact on them based on the current TLS 1.3 specification.
> I'm not sure if this approach is useful, I'm afraid.  The draft is
> basically a collection of man-in-the-middle attacks many people would
> consider benign.  It's unclear where the line is drawn: traffic
> optimization/compression and ad suppression/replacement aren't
> mentioned, for example, and I would expect both to be rather low on
> the scale of offensiveness.
We didn't draw any particular line, but the use case scenarios that we 
tried to highlight are those related to overall security and regulatory 
requirements (including public sector) where a network-based solution 
currently exists, and (we believe) is not easily replaced. A number of 
these are routinely encountered in present-day enterprise, cloud and 
public sector, and we believe they will continue to be relevant. On top 
of that, we have a rapidly expanding base of IoT endpoints with limited 
capabilities, which presents a whole new and highly vulnerable attack 
surface.

> What the draft is essentially arguing is that many user cannot afford
> end-to-end encryption for various reasons, some legal, some technical,
> some political.  But it seems to me that this is currently not a
> viewpoint shared by the IETF.
That is our read of the current situation as well, however the concern 
is that by focusing solely on privacy and e2e security, there are 
additional important considerations that are being ignored. Our intent 
with the draft is to illustrate some of those and see if we can get to 
some consensus around the need to address those (and/or possibly others).

Thanks

-- Flemming


> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls