Re: [TLS] draft-green-tls-static-dh-in-tls13-01

"Dobbins, Roland" <rdobbins@arbor.net> Wed, 19 July 2017 16:52 UTC

Return-Path: <rdobbins@arbor.net>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A2D92131A7D for <tls@ietfa.amsl.com>; Wed, 19 Jul 2017 09:52:39 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -4.701
X-Spam-Level:
X-Spam-Status: No, score=-4.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-2.8, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=thescout.onmicrosoft.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6GQcL9WWi41G for <tls@ietfa.amsl.com>; Wed, 19 Jul 2017 09:52:37 -0700 (PDT)
Received: from NAM02-BL2-obe.outbound.protection.outlook.com (mail-bl2nam02on0135.outbound.protection.outlook.com [104.47.38.135]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id ED859129482 for <tls@ietf.org>; Wed, 19 Jul 2017 09:52:36 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=thescout.onmicrosoft.com; s=selector1-arbor-net; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=GbjyLrlMGhupM+hlMYsms4XQigQEKU93AdzHVZwYFa4=; b=XVk+zf7anl84DABWnnwqHClb2be0BxEzOWw+vOXsmt7l15nEX07pW+s1W0bPGhvR9Rgb+qy2s+Y/iUyZVSE3iXWDPLQIE+hSjZohtT2zqjjQ1dhTEar9S3k954F1gjShhI9QBADjzKwc17+0ruzMJ8eg3WY495QkV3nu2m3V/+E=
Received: from DM2PR0101MB1039.prod.exchangelabs.com (10.160.129.156) by DM2PR0101MB1038.prod.exchangelabs.com (10.160.129.155) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1261.13; Wed, 19 Jul 2017 16:52:35 +0000
Received: from DM2PR0101MB1039.prod.exchangelabs.com ([fe80::810f:2255:5d85:2fc7]) by DM2PR0101MB1039.prod.exchangelabs.com ([fe80::810f:2255:5d85:2fc7%17]) with mapi id 15.01.1261.024; Wed, 19 Jul 2017 16:52:34 +0000
From: "Dobbins, Roland" <rdobbins@arbor.net>
To: Colm MacCárthaigh <colm@allcosts.net>
CC: "Blumenthal, Uri - 0553 - MITLL" <uri@ll.mit.edu>, "tls@ietf.org" <tls@ietf.org>
Thread-Topic: [TLS] draft-green-tls-static-dh-in-tls13-01
Thread-Index: AQHS/ulnreU48MdBA0WwDcIvwebnRKJYYxaAgAB6VYCAAmD9gIAAGYsAgAAB3ICAAAJ0AIAABMBa
Date: Wed, 19 Jul 2017 16:52:34 +0000
Message-ID: <FDC8499C-FA96-4992-B1F2-C90F6154856B@arbor.net>
References: <CAPCANN-xgf3auqy+pFfL6VO5GpEsCCHYkROAwiB1u=8a4yj+Fg@mail.gmail.com> <CAOjisRxxN9QjCqmDpkBOsEhEc7XCpM9Hk9QSSAO65XDPNegy0w@mail.gmail.com> <CABtrr-XbJMYQ+FTQQiSw2gmDVjnpuhgJb3GTWXvLkNewwuJmUg@mail.gmail.com> <72BACCE6-CCB9-4DE9-84E6-0F942E8C7093@gmail.com> <a0a7b2ed-8017-9a54-fec0-6156c31bbbfa@nomountain.net> <6AF150DF-D3C8-4A4A-9D56-617C56539A6E@arbor.net> <CAN2QdAGRTLyucM1-JPmDU17kQgAv0bPZNASh54v=XoCW+qj48A@mail.gmail.com> <CACsn0cnc0X5++cOvTNsboda8J42qg3VDquZ4Va-X-YDcggnbvA@mail.gmail.com> <7423703D-5277-4F78-A2ED-1B7E152E7B08@arbor.net> <CACsn0cmo0HXBj7MidTTwkgE+Hwed9SrEODSzN8oURzQHJTW1aQ@mail.gmail.com> <E5BF12C2-B79A-444B-B4C2-90D28B40CCAC@arbor.net> <CACsn0c=_OT8R6SSr0P3RvT7Qx+smfz1DAKjH9Gni+jM8Ue4v5A@mail.gmail.com> <CAAF6GDc9e9TGWVaOjdb83AFH=z2kt41Rje+r4Ureoc6KVgEUJg@mail.gmail.com> <B08F0D98-FAE9-494C-AA96-4CE89792B770@ll.mit.edu>, <CAAF6GDdSnCggfsrSG68An348ngR+fcb+9nQcKvJJGFtxg8NzJw@mail.gmail.com>
In-Reply-To: <CAAF6GDdSnCggfsrSG68An348ngR+fcb+9nQcKvJJGFtxg8NzJw@mail.gmail.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
authentication-results: allcosts.net; dkim=none (message not signed) header.d=none;allcosts.net; dmarc=none action=none header.from=arbor.net;
x-originating-ip: [88.208.89.131]
x-ms-publictraffictype: Email
x-microsoft-exchange-diagnostics: 1; DM2PR0101MB1038; 7:QJAUNeAxXmBqu9Ng0RfR13V6zNXSYhj3FgOyC4t1e5y1BkB71jjsEtcG+lXZMg+v9QYkKDO23BTLFCcUMfB2+jj9aMCBb0B28N7/Tg+lglPN8eoliEM2WD/pmZG1ZPBuwc5MkCYKwO0DsZW5c1VZkC6/hojKehqdQfONQ63TaB+UrSgkpGmNcKBsXtmtsRBMv6hKdcM0VfTqj5XXBNw+jr8varIGSzK4YAme0VNKOVgmPJe5rq5DF53cfN3C6CURs2JABS0D4Zqkdm1H8osaROJnzqOboarZYX/5XZJ4zIzUZX+/bG21Dpol/so56RjoWV4Rr3db75zOi23BowElyzxsj9OfJZiU8YgLMkO/99XP4B3ezUxtgrWn4KBbg1+ZX6FfhsB2k3eJM9TtBYVeS4Rs3n+vY2hTAlbSR+B6mMe1CTbfYsRguZKiDTPY6NMLIQAiKCunWCjyNBNwRInA5BFURKCuxaVc7za57MYdhLbcp/zeJMsv11BTci3ET6qfQDNFGEEmNw3ee76i6ME+Rw3FQ3gVAXunIrUh/zgDqfPc5j5/nfEe6O15M46gtWcA3GTqQAreHfQq41AoR61QA+Q0p4SYfgOyhSbxQIPs/8kO7vP0dYKyh1sFsmRRgZ7OQiX9a0YDokSRDR7tyVgNJ51KAHZ5GOygvYT+hR9zA8pSJCNJ8ijvSe4nJpYN+LZhp+07uWh1RHj0GCyymnCe3yUVc90k3ewRIqKKzsDzg9gmigN3kRV0AYgJRSGUu02+Zyef2N/M3YepZyjor7ET5oMw/e50JLbT70oRYUYdjG8=
x-ms-office365-filtering-correlation-id: 2138e280-47a6-4357-5243-08d4cec68dfe
x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(300000500095)(300135000095)(300000501095)(300135300095)(22001)(300000502095)(300135100095)(2017030254075)(300000503095)(300135400095)(2017052603031)(201703131423075)(201703031133081)(201702281549075)(300000504095)(300135200095)(300000505095)(300135600095)(300000506095)(300135500095); SRVR:DM2PR0101MB1038;
x-ms-traffictypediagnostic: DM2PR0101MB1038:
x-exchange-antispam-report-test: UriScan:(236129657087228)(192374486261705)(17755550239193);
x-microsoft-antispam-prvs: <DM2PR0101MB103851F32C48391BD751FEC9CAA60@DM2PR0101MB1038.prod.exchangelabs.com>
x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(100000700101)(100105000095)(100000701101)(100105300095)(100000702101)(100105100095)(6040450)(2401047)(2017060910075)(5005006)(8121501046)(3002001)(100000703101)(100105400095)(93006095)(93001095)(10201501046)(6041248)(20161123555025)(20161123562025)(20161123564025)(20161123558100)(201703131423075)(201702281528075)(201703061421075)(201703061406153)(20161123560025)(6072148)(100000704101)(100105200095)(100000705101)(100105500095); SRVR:DM2PR0101MB1038; BCL:0; PCL:0; RULEID:(100000800101)(100110000095)(100000801101)(100110300095)(100000802101)(100110100095)(100000803101)(100110400095)(100000804101)(100110200095)(100000805101)(100110500095); SRVR:DM2PR0101MB1038;
x-forefront-prvs: 0373D94D15
x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(6009001)(39410400002)(39450400003)(39400400002)(39840400002)(24454002)(66066001)(99286003)(54906002)(6436002)(2950100002)(189998001)(82746002)(2906002)(6512007)(83716003)(6916009)(86362001)(3846002)(6116002)(102836003)(6486002)(33656002)(478600001)(2900100001)(14454004)(6506006)(305945005)(7736002)(3660700001)(230783001)(93886004)(38730400002)(6246003)(110136004)(4326008)(5660300001)(8676002)(53936002)(53546010)(5250100002)(81166006)(25786009)(36756003)(50986999)(76176999)(3280700002)(54356999)(229853002)(8936002); DIR:OUT; SFP:1102; SCL:1; SRVR:DM2PR0101MB1038; H:DM2PR0101MB1039.prod.exchangelabs.com; FPR:; SPF:None; MLV:sfv; LANG:en;
spamdiagnosticoutput: 1:99
spamdiagnosticmetadata: NSPM
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: base64
MIME-Version: 1.0
X-OriginatorOrg: arbor.net
X-MS-Exchange-CrossTenant-originalarrivaltime: 19 Jul 2017 16:52:34.5621 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 54f11205-d4aa-4809-bd36-0b542199c5b2
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM2PR0101MB1038
Archived-At: <https://mailarchive.ietf.org/arch/msg/tls/j0mpq1a-c4MAo-hkxSb9CkjAPrQ>
Subject: Re: [TLS] draft-green-tls-static-dh-in-tls13-01
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 19 Jul 2017 16:52:40 -0000


> On Jul 19, 2017, at 18:35, Colm MacCárthaigh <colm@allcosts.net> wrote:
> 
> That's not what I've seen. Instead, I see administrators creating port mirrors on demand and then filtering the traffic they are interested in using standard tcpdump rules, and I see MITM boxes that selectively decrypt some traffic to look inside it and apply some kind of security filtering. In the former case, DNS lookups and IP/port destinations are commonly used to trigger some suspicions too. 

Correct.

> That's not how the tcpdump/wireshark approach usually works. You give it the private key and decrypts the TLS connection as it's happening.

Correct. 

Ex-post-facto is insufficient to purpose.  Real-time is the focus.  Archiving is rarely done, and is typically just snippets representative of the incident in question. 

-----------------------------------
Roland Dobbins <rdobbins@arbor.net>