IETF Logo Mail Archive

Re: [TLS] ETSI releases standards for enterprise security and data centre management

Andrei Popov <Andrei.Popov@microsoft.com> Thu, 06 December 2018 02:10 UTC

Return-Path: <Andrei.Popov@microsoft.com>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D7B5C128DFD for <tls@ietfa.amsl.com>; Wed, 5 Dec 2018 18:10:12 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.461
X-Spam-Level:
X-Spam-Status: No, score=-3.461 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-1.46, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id eFoD1RORlmkz for <tls@ietfa.amsl.com>; Wed, 5 Dec 2018 18:10:11 -0800 (PST)
Received: from NAM05-BY2-obe.outbound.protection.outlook.com (mail-eopbgr710096.outbound.protection.outlook.com [40.107.71.96]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id F3003130E0E for <tls@ietf.org>; Wed, 5 Dec 2018 18:10:08 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=CNBHw/m52aJKUqKqkkartFWi+Dl3CMjqgSnoNapTat4=; b=Xa0i2EjXUOMXNA6hrEOOJRngzJrJgmAENhPkA7Q28Fd1lafnNFMDR6BuQvtyUOsG0zMqskqwAuKRWVtnOCK/d761lTly3s38aXCvWDSzzYHutu6iISq75nUzjertZ8C3OyeZdNxHg+TnU+B+HofcdySY5b0QyPIPLgNkKTf8SRA=
Received: from SN6PR2101MB1055.namprd21.prod.outlook.com (52.132.115.16) by SN6PR2101MB0896.namprd21.prod.outlook.com (52.132.116.161) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1425.2; Thu, 6 Dec 2018 02:10:06 +0000
Received: from SN6PR2101MB1055.namprd21.prod.outlook.com ([fe80::2902:9c4b:abe3:5710]) by SN6PR2101MB1055.namprd21.prod.outlook.com ([fe80::2902:9c4b:abe3:5710%2]) with mapi id 15.20.1425.009; Thu, 6 Dec 2018 02:10:06 +0000
From: Andrei Popov <Andrei.Popov@microsoft.com>
To: Daniel Kahn Gillmor <dkg@fifthhorseman.net>, "tls@ietf.org" <tls@ietf.org>
Thread-Topic: [TLS] ETSI releases standards for enterprise security and data centre management
Thread-Index: AQHUiVXbSQd8ESeelkaHiH5z15w1GaVqCxWAgAIRyACAAqqFAIABCW0AgAARrwCAABOTgIAAAw6AgAALxACAAFddgIAACkUAgACRLzA=
Date: Thu, 06 Dec 2018 02:10:06 +0000
Message-ID: <SN6PR2101MB1055D37EB2DD393B9DB042238CA90@SN6PR2101MB1055.namprd21.prod.outlook.com>
References: <CADqLbzKd-AgDRv2suZ-0Nz4jNUqKg0RNT8sgQd-n793t+gEN3g@mail.gmail.com> <CAHOTMVKZT1ScvHeP3=Kv2zodVimHkaAtG-2DTq6ojnF+q-OMSQ@mail.gmail.com> <20181202233553.GD15561@localhost> <CAHOTMV+vPkM-=Qsto-8-ipFuGsNKkH_U=BEY_mB=7CM7tto3Mw@mail.gmail.com> <38D10A65-B4EE-4E81-8EA4-D69514F7F47B@gmail.com> <51754d91-c00c-0cad-ecd6-8db74544d26a@cs.tcd.ie> <A7423BAF-398B-4BBE-81AC-364CE748D6B1@gmail.com> <9344c0e1-f484-2b4b-8594-1d29731f6b7a@cs.tcd.ie> <01429BF7-BF1D-4F1C-9E18-D796A5585E62@gmail.com> <2F72F9A9-1556-4F44-8BBA-4D4CDD1A310C@akamai.com> <cd138d5d-37be-acee-297c-011227e98b99@nomountain.net>
In-Reply-To: <cd138d5d-37be-acee-297c-011227e98b99@nomountain.net>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
x-originating-ip: [2001:4898:80e8:8:28b5:a023:971b:e42c]
x-ms-publictraffictype: Email
x-microsoft-exchange-diagnostics: 1; SN6PR2101MB0896; 6:STck4112YrVUFgw9K+PjOuhqj62gd/g/96mcLYP9caCzJ0kpxMKRvoNO744nVScgJVPHUxZT2VBiOgGxH4exw8MTcRKXA0fALDF79DzNCGL5pAe1p1gEvaFgwQF/r1GLMvSlV9qSxIMA5thVdrcCQwdbvOoh6QrzB1ljDbv+n3KZS1S78Sz0FCFfC83JGgCnVObwopxm6C4dkKlH10fCX5zbAGfFqqz2ZncDiHhJb7Z35iDs08viBtKl9Xqibk2HME8XwGNiXYAdhxd1+7VsAOUofy0SgWwD0Da2vbbSzKtuu4uN2hXOAgd/GGNkzh1xo9QnVMLUOBV7IqWEkKtO70znOtyfWWE+IC8xxNwazykqZBJsXmL2s5fhc+ER0mHMgRXx1s0KEiiRd8h8i2pho1R/VK4jmY72ulAoUVI0OECzQ0SyFRulYN/ZQ2D3baLvUFg4Hx0OQivv85uD2T6Vig==; 5:11ANE4bIPa9xWFSKam2UuEmSXDNec9SOiILsGcmGuv9g0BeAvTvGgk5H/F1Uandp6cpEdQvdm4efsww2zNErbQciLKqlBAwO5SFViILvfuVqxQYP1OuJY6a4lw0oRIZKXZvD96DAy6xjhy0JKZjGFKAcXleKajTgA6QoUYSGkGQ=; 7:00X9Q9BlC/rDZYRyfqkn/zzJP7IjgriP1tOf2/MTK7EO6IPY6GlwS25CpPcbWx9pi4ynxihlo18MSUn6x479/8JMSoqVd0OKCw54XCJax4dWFEaH2Qvff7N4kAuXPPF6q79MkpbgAfAZn7A0NZMhGQ==
x-ms-exchange-antispam-srfa-diagnostics: SOS;
x-ms-office365-filtering-correlation-id: 36b97011-903b-42ee-bacf-08d65b1ff131
x-ms-office365-filtering-ht: Tenant
x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390098)(7020095)(4652040)(8989299)(5600074)(711020)(4618075)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(2017052603328)(7193020); SRVR:SN6PR2101MB0896;
x-ms-traffictypediagnostic: SN6PR2101MB0896:
x-ms-exchange-purlcount: -3
authentication-results: spf=none (sender IP is ) smtp.mailfrom=Andrei.Popov@microsoft.com;
x-microsoft-antispam-prvs: <SN6PR2101MB0896A6FE30A9EBC7AEDFD1228CA90@SN6PR2101MB0896.namprd21.prod.outlook.com>
x-ms-exchange-senderadcheck: 1
x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(8211001083)(3230008)(999002)(6040522)(8220035)(2401047)(5005006)(8121501046)(3231463)(944501520)(2018427008)(93006095)(93001095)(10201501046)(3002001)(6055026)(148016)(149066)(150057)(6041310)(20161123564045)(20161123562045)(201703131423095)(201702281528075)(20161123555045)(201703061421075)(201703061406153)(20161123558120)(20161123560045)(201708071742011)(7699051)(76991095); SRVR:SN6PR2101MB0896; BCL:0; PCL:0; RULEID:; SRVR:SN6PR2101MB0896;
x-forefront-prvs: 087894CD3C
x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(376002)(39860400002)(346002)(136003)(396003)(366004)(189003)(199004)(33656002)(76176011)(305945005)(68736007)(7736002)(74316002)(102836004)(186003)(6506007)(316002)(110136005)(8676002)(97736004)(229853002)(5660300001)(81156014)(8936002)(81166006)(93886005)(2501003)(22452003)(8990500004)(446003)(6246003)(11346002)(10290500003)(25786009)(486006)(105586002)(72206003)(476003)(478600001)(106356001)(55016002)(9686003)(14454004)(6436002)(10090500001)(53936002)(46003)(86362001)(6116002)(71190400001)(71200400001)(256004)(7696005)(2906002)(86612001)(99286004); DIR:OUT; SFP:1102; SCL:1; SRVR:SN6PR2101MB0896; H:SN6PR2101MB1055.namprd21.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1;
received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts)
x-microsoft-antispam-message-info: ZGPWDPDYLNXGgkLqkYH3wBXECNUEAN9IzjzpwyqeJbJ+wCtCJH9UJRFlWSEy37utJCVSqkYhvUsbtRtWZ9QOCaiYY7Vl24i/Q+rFgscOQEX8J7NDoSkAef2+EnA5RBX2gwi7tCSVLBNg5Ciz/7NxYrr8s2KlJwnj6fO7TxMHpzPznOOy06pDKQPnjVUI1aNAQu0pqpmpMHZrhn5AiHgYLf2u5AgA/oaAB+acozBRFLhRQFJ9M4XXVu07h8h9kU4njO9NTwRggKfCy4AORbwR4Gsxe/933QYrKR6Ko7pZYK6hKgDrg4b2b4Y7VGOYGm6z5SaB4FFWy/amsTERrQdypqkF91RkAn067APsAAf6FqM=
spamdiagnosticoutput: 1:99
spamdiagnosticmetadata: NSPM
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: base64
MIME-Version: 1.0
X-OriginatorOrg: microsoft.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 36b97011-903b-42ee-bacf-08d65b1ff131
X-MS-Exchange-CrossTenant-originalarrivaltime: 06 Dec 2018 02:10:06.6914 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47
X-MS-Exchange-Transport-CrossTenantHeadersStamped: SN6PR2101MB0896
Archived-At: <https://mailarchive.ietf.org/arch/msg/tls/HRUrbMKdGsUqDahfd3GYsB7HsW0>
Subject: Re: [TLS] ETSI releases standards for enterprise security and data centre management
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 06 Dec 2018 02:10:13 -0000

I like the intent of draft-dkg-tls-reject-static-dh-01, but this part will cost servers some perf:

   "Given the concerns in Section 2 and the necessary client mitigations
   in the subsections above, servers need to avoid giving the appearance
   of using non-ephemeral DH.  Servers MUST NOT reuse ephemeral DH
   shares."

In our tests, we see significant drop in handshakes/sec on a busy TLS server with ephemeral DH share reuse time < 1 sec.

Also, won't the "enterprise TLS" server just create a bunch of static DH shares and send different ones at different times, thereby avoiding detection by most clients?

Cheers,

Andrei

v2.23.0 | Report a Bug | By Email