Re: [TLS] ETSI releases standards for enterprise security and data centre management

[R duToit <[e-mail]>]

I like the gist of what Tony is saying.  Key escrow (it should be called "secret escrow", but I digress) itself is not really the problem in a datacenter - those guys struggle to solve the key distribution problem.  If it was one-server-to-one-tool then we would not be having this discussion.  eTLS looks like an attempt to simplify the key distribution implementation, but at the expense of the security attributes of the TLS session. Why don't we provide a "sandbox" mechanism that would allow business-solution folks to solve the key distribution problem without directly affecting the TLS session?  What I have in mind is a TLS extension that would unlock a new TLS record ContentType called "foo" (for lack of a name).  All "foo" records will be completely ignored by the TLS stack, including not affecting the TLS record sequence number or crypto state.  That mechanism can then be used to send in-band messages that could be picked up by inline and passive tools along the way.  Mechanisms that use "foo" records could potentially be designed outside the IETF, and the TLS-WG would have no responsibility for insecure implementations of multi-party secret sharing mechanisms (although it would be good to point those engineers in the right direction). --Roelof ---- On Wed, 05 Dec 2018 10:51:26 -0500 Tony Arcieri <[e-mail]> wrote ---- On Wed, Dec 5, 2018 at 12:09 AM Bret Jordan <[e-mail]> wrote: Now this WG is finally starting to talk about a solution to a real problem and need.  We can either address the use case and need here in the IETF, or we can let the solutions be done else where. I would personally prefer we take this work item back and solve it here in the IETF. [...] On Dec 5, 2018, at 1:18 AM, Tony Arcieri <[e-mail]> wrote: [...] It seems like with an out-of-band escrow agent, the traffic secrets could be escrowed with no changes to TLS. Note that the solution I was proposing here requires no changes to TLS. I am sure that there are many in the IETF who would be happy with people exploring solutions which don't require changes to TLS. Here are some others: Endpoint agents (OSS - commercial options are also available): https://osquery..io/ https://www.bro.org/ (now Zeek) https://wazuh.com/ Encrypted traffic analytics: https://blogs.cisco.com/security/tls-version-1-3-change-is-here-and-encrypted-traffic-analytics-has-got-your-back -- Tony Arcieri _______________________________________________ TLS mailing list [e-mail] https://www.ietf.org/mailman/listinfo/tls