Re: [TLS] TLS Proxy Server Extension

[Yoav Nir <[e-mail]>]

On Aug 3, 2011, at 1:27 AM, Joshua Davies wrote:

> > I haven't heard any use cases for the TLS proxy in this discussion
> > that are not factually equivalent to wiretapping.
> 
> Hm - it may be factually equivalent to wiretapping, but I can think of a perfectly legitimate use case for a TLS proxy which MITM's a client, with that client's express consent and knowledge of course - wire-level debugging of an encrypted session.  I've set something like this up a couple of times to debug a server that doesn't accept plaintext connections but is still not behaving correctly; I create a proxy that presents a self-signed certificate to the client, ignore the security pop-up warning, and then proxy again to the server (logging everything in between).  In this case, I'm "wiretapping", but I'm wiretapping myself.

A TLS proxy is just a piece of technology, much like a microphone and a tape recorder. Legality depends on the use, not on technology.

The use-case that interests me is deep firewall inspection. HTTP connections are routinely inspected by firewalls for downloaded malware, cross-site scripting, and various other attacks. Without a TLS proxy, HTTPS connections can either slip under the radar or get blocked entirely. That would have been fine a few years ago, when SSL was only used for shopping and banking sites (you could defer your shopping and banking for when you were home). These days the use of HTTPS is becoming more prevalent, so blocking HTTPS is no longer a good option. A TLS proxy allows an organization to use HTTPS while still applying company policy and defenses.

I'm not saying this is all good. There are some real problems with using a proxy:
- The same technology can be used for wiretapping, and the user cannot tell the difference between a good proxy and an evil one.
- The client does not get to validate the server on its own (the subject draft is an attempt to solve this)
- Client certificates and PSK ciphersuites are broken.

I think with a little modification the draft can solve the first two problems.

Yoav