Re: [TLS] ETSI releases standards for enterprise security and data centre management

[Daniel Kahn Gillmor <[e-mail]>]

On Wed 2018-12-05 17:08:44 +0900, Bret Jordan wrote:
> Now this WG is finally starting to talk about a solution to a real
> problem and need.  We can either address the use case and need here in
> the IETF, or we can let the solutions be done else where. I would
> personally prefer we take this work item back and solve it here in the
> IETF.

Or, the IETF can say with relative clarity that this kind of information
leakage is inappropriate for and incomaptible with the information
security goals of TLS.

> Finally, remember, you may not like the use case or need, but that
> does not mean the use case is not valid and needed.

Sure, but just because someone says it is, doesn't mean that the use
case is valid or needed within the scope of TLS either.

Throughout the (several years now) discussion of this sort of proposal,
we've repeatedly heard about "legal obligations" which somehow evaporate
when pressed for details.  And we've heard about "operational
considerations" which typically amount to cost-shifting concerns (they
can come across as: "we've invested a bunch of money in this particular
network architecture/application design, please change the infosec
guarantees provided by TLS for everyone on the global network so that we
don't have to do an expensive re-tooling or staff up on new skills while
i'm responsible for this budget line item").

The WG is chartered to make TLS a fast, secure, confidential transport
layer.  Let's keep the charter goals in mind.

        --dkg