Re: [TLS] Publication of draft-rhrd-tls-tls13-visibility-00

[Dave Garrett <[e-mail]>]

On 10/23/2017 12:39 PM, Ackermann, Michael wrote:
>  2. Modifying Server,  application and logging infrastructure is a huge,
>     expensive proposition,  that executive management would not be
>     receptive to at all.   Not to mention the logistics to follow if
>     they were.

I'd just like to have everyone stop and focus on this, right here. This 
is the crux of everything. It takes effort and resources to upgrade your 
systems, and you don't want to do it. Tough; this is not the TLS WG's 
problem. The job here is to design the most secure protocol possible, 
and weakening things significantly to accommodate legacy methods is not 
a realistic option. Organizations will *always* have to expend effort 
and resources to upgrade to better systems. If that can be reduced 
without affecting security, great, but if not, then you're just going to 
have to accept it. People should not be here arguing against technical 
improvements; they should be with their managers explaining the simple 
reality of the situation. Yeah, I know it's hard to explain to executive 
management that they are not in control here, but they aren't.

I count at least 400+ messages on this list on this one topic. The 
answer is still "no". You're not getting a cheap drop-in replacement for 
your existing insecure use of static RSA keys out of this WG. Fixing 
devil's advocate qualms like whether or not clients have to send an 
extension is not enough to get even a rough consensus. Nontrivial, but 
very much viable, effort and resources will be required to upgrade.

https://en.wikipedia.org/wiki/Technical_debt


Dave