Re: [TLS] chairs - please shutdown wiretapping discussion...

["Ackermann, Michael" <[e-mail]>]

I am not certain if I speak for all Enterprise individuals involved in this discourse or not.
But I would like to endorse what Ted is saying.

As much fun as this debate has become (not),  Enterprises originally raised this issue to the TLS-WG,  to engage their considerable expertise, and to help solve what will be a huge business problem,  when TLS 1.3 is implemented.
I believe all of us Enterprise people would prefer to work with the SMEs at TLS-WG, to determine the best possible answer to this very real issue we will all face.     That is why we came to this WG.
The draft proposal is the best solution I have heard.   If there is a better approach, we all need to be open to this, as well as open to perspectives on both sides of this issue.    IMHO we want to work with the TLS-WG, not work around it, in an effort to craft the best possible solution(s),  with ALL related issues addressed.

From: TLS [mailto:[e-mail]] On Behalf Of Ted Lemon
Sent: Tuesday, July 11, 2017 7:02 AM
To: Stephen Farrell <[e-mail]>
Cc: Polk, Tim (Fed) <[e-mail]>; IETF TLS <[e-mail]>
Subject: Re: [TLS] chairs - please shutdown wiretapping discussion...

On Jul 10, 2017, at 5:35 PM, Stephen Farrell <[e-mail]<mailto:[e-mail]>> wrote:
Consider SMTP/TLS. Where one MTA on the path supports this.
Say it's one operated by an anti-spam company for example.
That is clearly not the sender nor recipient.

That meets all 4 points in 2804, right?

I don't buy this, Stephen.   The anti-spam company is not an eavesdropper.

What I don't understand about your approach to this draft is that it seems to me that the draft is obviously describing an exploit in TLS 1.3, for which a mitigation exists: remember keys, and refuse to communicate with an endpoint that presents a key you've seen before.

So rather than opposing the publication of the static keys draft, why not work on mitigating the attack it describes?   This attack exists whether the static keys draft is published or not.



The information contained in this communication is highly confidential and is intended solely for the use of the individual(s) to whom this communication is directed. If you are not the intended recipient, you are hereby notified that any viewing, copying, disclosure or distribution of this information is prohibited. Please notify the sender, by electronic mail or telephone, of any unintended receipt and delete the original message without making any copies.
 
 Blue Cross Blue Shield of Michigan and Blue Care Network of Michigan are nonprofit corporations and independent licensees of the Blue Cross and Blue Shield Association.