IETF Logo Mail Archive

Re: [TLS] Industry Concerns about TLS 1.3

"Salz, Rich" <rsalz@akamai.com> Fri, 23 September 2016 20:52 UTC

Return-Path: <rsalz@akamai.com>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D608F12BE03 for <tls@ietfa.amsl.com>; Fri, 23 Sep 2016 13:52:43 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -5.017
X-Spam-Level:
X-Spam-Status: No, score=-5.017 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RP_MATCHES_RCVD=-2.316, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=akamai.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id aJLZVTGETqum for <tls@ietfa.amsl.com>; Fri, 23 Sep 2016 13:52:42 -0700 (PDT)
Received: from prod-mail-xrelay07.akamai.com (prod-mail-xrelay07.akamai.com [23.79.238.175]) by ietfa.amsl.com (Postfix) with ESMTP id 2F13412BDC2 for <tls@ietf.org>; Fri, 23 Sep 2016 13:52:42 -0700 (PDT)
Received: from prod-mail-xrelay07.akamai.com (localhost.localdomain [127.0.0.1]) by postfix.imss70 (Postfix) with ESMTP id B4360433489; Fri, 23 Sep 2016 20:52:41 +0000 (GMT)
Received: from prod-mail-relay10.akamai.com (prod-mail-relay10.akamai.com [172.27.118.251]) by prod-mail-xrelay07.akamai.com (Postfix) with ESMTP id 9E53C43340A; Fri, 23 Sep 2016 20:52:41 +0000 (GMT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=akamai.com; s=a1; t=1474663961; bh=dbqQ1Lz987etocN/tkD+gl/v7qxEYZxMDbIOudFpH/I=; l=724; h=From:To:CC:Date:References:In-Reply-To:From; b=RrtFCnXwyTD+h/eF5ufwDHeTTfpIaknDr7OqhokXCe2mKTiyyHEVh2phgaVxrwrQ4 kyCb9Ex7NOJdAWXBumg4CsdYhcuzyugZqlClIlLYgvc2r9CRLFoRuNwyB9RwMo9Mtd P4BZlrLYpuct7NIwTRS7gZXr481IkcFSmjfmxWvs=
Received: from email.msg.corp.akamai.com (usma1ex-cas1.msg.corp.akamai.com [172.27.123.30]) by prod-mail-relay10.akamai.com (Postfix) with ESMTP id 9B6571FC8C; Fri, 23 Sep 2016 20:52:41 +0000 (GMT)
Received: from USMA1EX-DAG1MB1.msg.corp.akamai.com (172.27.123.101) by usma1ex-dag1mb1.msg.corp.akamai.com (172.27.123.101) with Microsoft SMTP Server (TLS) id 15.0.1178.4; Fri, 23 Sep 2016 16:52:40 -0400
Received: from USMA1EX-DAG1MB1.msg.corp.akamai.com ([172.27.123.101]) by usma1ex-dag1mb1.msg.corp.akamai.com ([172.27.123.101]) with mapi id 15.00.1178.000; Fri, 23 Sep 2016 16:52:40 -0400
From: "Salz, Rich" <rsalz@akamai.com>
To: BITS Security <BITSSecurity@fsroundtable.org>, "nalini.elkins@insidethestack.com" <nalini.elkins@insidethestack.com>
Thread-Topic: [TLS] Industry Concerns about TLS 1.3
Thread-Index: AdIU8WqWM9WBapZoQzyfqxiOaK25fQADrwVgACSrSIAADgIdgAAAS/+AAAFEjIAAAGtwAAACvFsAAATvGdAAAl4bAAAHzzrw
Date: Fri, 23 Sep 2016 20:52:40 +0000
Message-ID: <890957bafbdc4c3381bc0a26c77d55a7@usma1ex-dag1mb1.msg.corp.akamai.com>
References: <DM5PR11MB1419B782D2BEF0E0A35E420DF4C90@DM5PR11MB1419.namprd11.prod.outlook.com> <CO1PR07MB283F2C414B6478E993675DEC3C90@CO1PR07MB283.namprd07.prod.outlook.com> <394611bf-208f-03d3-620c-79aaf169645b@cs.tcd.ie> <4FC37E442D05A748896589E468752CAA0DBC66AE@PWN401EA120.ent.corp.bcbsm.com> <CAH8yC8kgYzYXwJ01NkK7WYxD-diponWEQOd+MNHssm+bLHE54w@mail.gmail.com> <4FC37E442D05A748896589E468752CAA0DBC699B@PWN401EA120.ent.corp.bcbsm.com> <CACsn0c=5vjzQmr=ah6sH1JzTj3peaKad7aCPertcqD4B2DLKiA@mail.gmail.com> <72011214.413503.1474650126973@mail.yahoo.com> <e24a06b8d0d04ccc80b9a55d83bf5606@usma1ex-dag1mb1.msg.corp.akamai.com> <DM5PR11MB141926C5806296FFD7252A45F4C80@DM5PR11MB1419.namprd11.prod.outlook.com>
In-Reply-To: <DM5PR11MB141926C5806296FFD7252A45F4C80@DM5PR11MB1419.namprd11.prod.outlook.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
x-ms-exchange-transport-fromentityheader: Hosted
x-originating-ip: [172.19.46.163]
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: base64
MIME-Version: 1.0
Archived-At: <https://mailarchive.ietf.org/arch/msg/tls/u-1U10vURGoeCWpajZWCNP9nvEI>
Cc: "tls@ietf.org" <tls@ietf.org>
Subject: Re: [TLS] Industry Concerns about TLS 1.3
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.17
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 23 Sep 2016 20:52:44 -0000

> What is happening from our perspective is choice is being removed and an
> adequate replacement has (seemingly) not been identified.

So far I've seen two alternatives mentioned.  Monitor at the endpoint, and use TLS 1.2.  (You already have the PFS issue with TLS 1.1 and beyond).

Not everything the IETF does will drop seamlessly into all enterprise deployments.  But hey, at least you're not running SNA networks any more :)
--  
Senior Architect, Akamai Technologies
IM: richsalz@jabber.at Twitter: RichSalz

v2.23.0 | Report a Bug | By Email