IETF Logo Mail Archive

Re: [TLS] draft-rescorla-tls13-new-flows-01 - Thoughts post-meeting

Alyssa Rowan <akr@akr.io> Mon, 17 March 2014 07:31 UTC

Return-Path: <akr@akr.io>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 79D8B1A006E for <tls@ietfa.amsl.com>; Mon, 17 Mar 2014 00:31:51 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.902
X-Spam-Level:
X-Spam-Status: No, score=-1.902 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id el1gyEEP86le for <tls@ietfa.amsl.com>; Mon, 17 Mar 2014 00:31:49 -0700 (PDT)
Received: from entima.net (entima.net [78.129.143.175]) by ietfa.amsl.com (Postfix) with ESMTP id 699DD1A0270 for <tls@ietf.org>; Mon, 17 Mar 2014 00:31:49 -0700 (PDT)
Received: from [10.10.42.10] (cpc5-derb12-2-0-cust796.8-3.cable.virginm.net [82.31.91.29]) by entima.net (Postfix) with ESMTPSA id C85616015C for <tls@ietf.org>; Mon, 17 Mar 2014 07:31:40 +0000 (GMT)
Message-ID: <5326A478.1090907@akr.io>
Date: Mon, 17 Mar 2014 07:30:00 +0000
From: Alyssa Rowan <akr@akr.io>
MIME-Version: 1.0
To: tls@ietf.org
References: <5325DDA0.9030006@nthpermutation.com>
In-Reply-To: <5325DDA0.9030006@nthpermutation.com>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 7bit
Archived-At: http://mailarchive.ietf.org/arch/msg/tls/hq9sNkY0DWjotKErWdD1YNvFa70
Subject: Re: [TLS] draft-rescorla-tls13-new-flows-01 - Thoughts post-meeting
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 17 Mar 2014 07:31:51 -0000

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

On 16/03/2014 17:21, Michael StJohns wrote:

> The middle distributor box would

...have access to the keys if it's really owned by the same party.

Otherwise we're back to passive pervasive surveillance/censorship.

SNI needs to be _encrypted_ and we need to make sure that encryption
is resistant to matching against known-plaintext due to DNS lookups
and TLS 1.2 SNI currently being in cleartext (having not switched to
encrypted yet).

- -- 
/akr
-----BEGIN PGP SIGNATURE-----

iQIcBAEBCgAGBQJTJqR4AAoJEOyEjtkWi2t6nOwP/1yUsK3v+E6Paha8BTloygRG
9I5tfYvzjy05ZHiEFmESoWlpopM/MqJMXyD81jWXt8bpn2SwQrmzru3TmCbDENse
jVy5G26EwQfx4G8Njkg9dzHMR2pQVKLZUKg9B9N5vqGkWnlHiubSJSTZuNKx9XHi
DPLYyXw/UYA2Ys99BVPLLhH95DfNAUQQkkkThFQB8+9aQA80alIUcYb7mr/tflTf
Zt+IOvIgcx5vDDBI8uqfi+MDlMLSxsNzQ16AzolFzQSYXqPwJ9vZJ4/cfde92y/I
Z8gUwhcEQGzCcXh7rx0ZEknd/m8iWlAqZtpZOQF6cTA1fizwhADmjvA9DsLSXsc3
TtxjoHVdBey9w5PfXeR1/ADtfP0F/uvwdHcCWbXKUhrJ8QYIFzj5o6YblzxuzCJn
tKyfhmySKX/KG6pr/uXzgRr7VigSE3kOdZHM/7WdauoEpK49JuY4apCvziPUml2v
tatH7M2P7GrX6dLUARFk0Ri21ORcniP4nCxQM8oHTRJEHauV0MoLwRbEOlFZh70Q
M+YZUAHu57mf1z7XHzGQQiBoL0vnE9LEHSPxNnfdgLHvtNo9pI9N2eyrPCaWRVbF
9XQhkJ0HF5d9iii1hjbXGFf5c5y+Nb09rYqvTx0v99em8V6TIr0b82LfGrE/DPzk
YQguiAwiRn7gJ2L6397o
=32Ti
-----END PGP SIGNATURE-----

v2.27.8 | Report a Bug | By Email | System Status