Re: [TLS] [OPSEC] Call For Adoption: draft-wang-opsec-tls-proxy-bp

Nick Harper <> Wed, 29 July 2020 00:35 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 8396A3A0D1C for <>; Tue, 28 Jul 2020 17:35:16 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -17.599
X-Spam-Status: No, score=-17.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5] autolearn=unavailable autolearn_force=no
Authentication-Results: (amavisd-new); dkim=pass (2048-bit key)
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id E-aHK0v29Z8J for <>; Tue, 28 Jul 2020 17:35:12 -0700 (PDT)
Received: from ( [IPv6:2607:f8b0:4864:20::c32]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by (Postfix) with ESMTPS id DB57C3A0D36 for <>; Tue, 28 Jul 2020 17:35:11 -0700 (PDT)
Received: by with SMTP id w1so4188183ooj.2 for <>; Tue, 28 Jul 2020 17:35:11 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=DiVMhP6rguChkU1zMqGnUqDW8CJP8K3GYzcGnwxiKjs=; b=S7vJ6xY9J88qP3R1B2BPEHyL3OVNzQfkSEC7p6WByrFebSVs0zYFOvkUbWY49FA/w9 8rvPbgVUY8iFCSe6qafXBInJY1kz7pwY6uvZCqkaZNyURsPWtyL485yUxnIE+DG0Z6W6 ylV+v19nt+WJ6k/bajetmpShzjM0nrKxoSu82fGqgxy3CZkNBz1zqSp4wPMh9iy0hz+2 oAaMdWn8AI3ALVTbubztaT5QdTPP4ngyflJLGZ2kqbDa+8XEPwez5u/LXY5QcxyenAIZ 4e8RSCPO6Wn0ZZ09sasCam3wZEeDfX3gGpy7ea+c13VxnL5gI78mX2/YvcAbVd1YH63N OutQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=DiVMhP6rguChkU1zMqGnUqDW8CJP8K3GYzcGnwxiKjs=; b=MTm9sHVm1vlKUCMokILW3JijOd8dJuuO/uKrg1g+kyu12pLBLGEJNeP0S3HbA/63v7 1tvOdgehR4ZqaPTvsU8t8gbDx7Vg+42hP7HycYkfx4YldbQdxFFdD4F7FXGcKUO6DZLY 0MjknxfwK7Ygc3h2yOPBVgGWhRFOWMvPCuuZYGG7glRK1HpuR/y8h6VXosV67SbiCHLL jAhMWqC0OP43imsl6JK2/duQdi4G3y90VdcrbDM5oUjH5Goqf0HX5R28jLG+zYtrv6Fg BY6357R2Y8ncfwZ1yYrSGy1tm9SfKn6iCusNpWHdpI7ccEn0DkXI5to0rwK2QmCPVKho v+Zw==
X-Gm-Message-State: AOAM533Q5BMMGHPMIgdaE2uX1muHpI2chQ6UPO0A4r7e0ZDrH9sU52Ct /w0uaOzG2FoBmeBiUaj2e7gUOyJn1kKtXfx4tjgN6Q==
X-Google-Smtp-Source: ABdhPJz/gu1027CbP8drwcBGLvm0TIToZyGcqayKny1VZu7vkeSiR6EK+9lcOJOppAC+YUmQS2BRIlBuqy0AqaSCgMU=
X-Received: by 2002:a4a:9572:: with SMTP id n47mr19612383ooi.37.1595982910530; Tue, 28 Jul 2020 17:35:10 -0700 (PDT)
MIME-Version: 1.0
References: <> <> <>
In-Reply-To: <>
From: Nick Harper <>
Date: Tue, 28 Jul 2020 17:34:59 -0700
Message-ID: <>
To: "Eric Wang (ejwang)" <>
Cc: Martin Thomson <>, Ron Bonica <>, OPSEC <>, "" <>
Content-Type: multipart/alternative; boundary="00000000000073d73c05ab89babd"
Archived-At: <>
Subject: Re: [TLS] [OPSEC] Call For Adoption: draft-wang-opsec-tls-proxy-bp
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Wed, 29 Jul 2020 00:35:19 -0000

On Tue, Jul 28, 2020 at 2:19 PM Eric Wang (ejwang) <ejwang=> wrote:

> Thank you for the detailed comments.
> The scope of the document is limited to proxy at the TLS layer.
> Explicitly out of the scope is inspection of the proxied record data.
> Will clean up derivations from this scope.
> It was the intention to cover selective proxying however, because that is
> a practical requirement for an actual deployment.  The intention was to
> discuss the TLS layer attributes (e.g. SNI, Server Cert) that could be used
> as input for the decision.  The document also stated the requirement to
> gracefully remove the proxy from the session when needed (and possible).
> But the criteria for selective proxying decision, being compliance,
> privacy, risk level,... are out of the scope.  The decision making often
> falls under the larger “policy” domain and is controlled at system level
> outside of the proxy.  It also left out discussion on the detailed
> mechanism which was deemed as implementation specific.
> In any case, the proxy has to conduct selective proxying in a safe,
> non-disruptive manner. This may require more design work as you pointed
> out.  The document could describe possible mechanisms so that an acceptable
> practice could be discussed.  We are open to other ways to shape it.

An acceptable practice MUST include not violating the protocol invariants
in RFC 8446. It is not possible for a proxy to obey the protocol invariants
and selectively proxy based on the contents of the TLS handshake between
the proxy and the server a client wishes to connect to.

> More inline...
> Probably the worst problem is rooted in Section 5.1.  The introduction
> establishes this as being about proxying, but there are several places that
> talk about not-proxying sometimes.
> Selective non-proxying opens the document up to a whole new set of
> problems that arise from poor designs for deciding not to proxy.  There is
> not nearly enough detail here to address this problem properly.  A "good"
> design for selective TLS proxying does not seem to be the basis of the
> recommendations.  I'll give a few examples of problems.
> From the Section 4.8 again:
> the TLS proxy MUST conduct proper TLS protocol checks to avoid false
> identification of TLS handshakes, while taking special care not to
> contribute to protocol ossification.
> This practice has been directly responsible for more ossification than
> intermediation, no matter what qualification exists.
> If per-destination not-proxying is required, the proxy can connect to a
> server, determine that the server is on a non-proxy list, and then complete
> the handshake with the client (with a caveat regarding ECH here).  I can
> guess why this doesn't happen (it's expensive and see also Section 5.4),
> but that doesn't excuse the practice.
> The following text from Section 5.3 is deeply problematic:
>   A decryption policy decision MAY be made based on the server
>   certificate or other trustworthy parameters.  To verify possession of
>   private keys that are associated with a particular server
>   certificate, the proxy SHOULD complete an out-of-band TLS handshake
>   with the same TLS server IP address and TCP port as targeted by the
>   TLS client.
> It is possible that the authors misunderstand how TLS works, but this
> check won't work.  Not only because TLS 1.3 encrypts information, but
> because this is only necessary if the proxy forwards a ClientHello from the
> client to the server.  At that point, it is too late and the damage has
> been done (see Andrei's review).
> Unless I misunderstood it, the document is suggesting the same as you
> listed.  Basically, the proxy makes a separate connection to the server as
> a client (“out-of-band” wrt to the originating client-server connection),
> retrieves the server’s certificate from the proxy-server handshake, and
> determines whether the server is on a non-proxying list or not.  If on the
> list, the proxy forwards the originating client CH as is to the server, and
> steps aways from the originating client-server handshake.

The proxy MUST generate a fresh ClientHello when doing this (something
Andrei and I previously mentioned). When the proxy makes its separate
connection to the server, the server can behave differently when responding
to the proxy compared to when it responds to the client, and could present
itself to the proxy as something innocuous that should not be proxied.
Assuming at this point that the proxy has held onto the client's
ClientHello (waiting for the response from the server to the proxy's
ClientHello), the proxy decides either to intercept this connection or
allow the client's ClientHello to go through to the server. When the proxy
allows the client's ClientHello to go through to the server (without
interception), there's no guarantee that the server will respond to the
client the same way it did to the proxy, or even that the identity the
server presented to the proxy is the server's real identity.

If the proxy copies extensions unknown to it from the client's ClientHello
to its own, then it will not be able to parse the response from the server
when the server acts on those unknown extensions. This caused a year of
delay in finishing TLS 1.3, and is bad for everyone. A malicious client and
cooperating server don't even need to use an extensibility point unknown to
the proxy to evade a proxy selectively terminating connections based on the
TLS handshake between the proxy and server.

This sort of selective proxying is fundamentally broken and should not be
recommended as a best practice.

> There are additional considerations in this approach (latency etc.). The
> document intentionally left out the details to implementations, but could
> also cover them if needed.
> There are a bunch of places where pure proxying - as described in the
> introduction - is not assumed.  This leads to the same problems already
> cited.  For instance, in Section 4.2:
> The proxy MAY remove cipher suites from a client-initiated Client Hello
> message, add new cipher suites, and re-order them in the proxy-initiated
> Client Hello message.
> Will clean up those texts based on this and other discussions.
> Best,
> -Eric
> _______________________________________________
> OPSEC mailing list
> _______________________________________________
> TLS mailing list