Re: [TLS] Encryption of TLS 1.3 content type

Michael StJohns <msj@nthpermutation.com> Mon, 28 July 2014 16:02 UTC

Message-ID: <53D673CB.1060703@nthpermutation.com>
Date: Mon, 28 Jul 2014 12:01:15 -0400
From: Michael StJohns <msj@nthpermutation.com>
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:24.0) Gecko/20100101 Thunderbird/24.6.0
MIME-Version: 1.0
To: tls@ietf.org
References: <9A043F3CF02CD34C8E74AC1594475C738EFB1969@uxcn10-5.UoA.auckland.ac.nz>
In-Reply-To: <9A043F3CF02CD34C8E74AC1594475C738EFB1969@uxcn10-5.UoA.auckland.ac.nz>
Content-Type: text/plain; charset="ISO-8859-1"; format="flowed"
Content-Transfer-Encoding: 7bit
Archived-At: http://mailarchive.ietf.org/arch/msg/tls/y88kdwo1h7rkAVtl2Z4gpE9JkzY
Subject: Re: [TLS] Encryption of TLS 1.3 content type
Precedence: list

On 7/28/2014 12:08 AM, Peter Gutmann wrote:
> Yoav Nir <ynir.ietf@gmail.com> writes:
>
>> I believe that changing the 5-byte record header will cause us trouble.
>> Passive IDS/IPS devices follow TLS streams to detect certain attacks. They
>> will cut connections.
> Is it really up to the TLS WG to break (or at least constrain) our designs
> in order to accomodate broken middleboxes?  They're not going to understand
> any of TLS 1.3 anyway and will need to be updated when it comes along, so why
> keep this legacy header just for them?

It depends on how widespread they are, and how deep they go into the 
packet.  If this is something that consumer NAT routers do, then its a 
big problem.  If this is something that commercial firewalls do, then 
its a big problem.

If TLS1.3 does not work on the networks deployed today,  I would doubt 
that TLS 1.3 would be deployed in any major way in any time less than a 
decade.

I don't know the reality of whether or not this will be a problem, but 
simply saying that it's not our problem is probably not useful. Data 
would be helpful.

Mike

>
> Peter.
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls
>
>

Re: [TLS] Encryption of TLS 1.3 content type Yoav Nir
Re: [TLS] Encryption of TLS 1.3 content type Fabrice Gautier
Re: [TLS] Encryption of TLS 1.3 content type Eric Rescorla
[TLS] Encryption of TLS 1.3 content type Joseph Salowey (jsalowey)
Re: [TLS] Encryption of TLS 1.3 content type Watson Ladd
Re: [TLS] Encryption of TLS 1.3 content type Colm MacCárthaigh
Re: [TLS] Encryption of TLS 1.3 content type Juho Vähä-Herttua
Re: [TLS] Encryption of TLS 1.3 content type Peter Gutmann
Re: [TLS] Encryption of TLS 1.3 content type Yoav Nir
Re: [TLS] Encryption of TLS 1.3 content type Nikos Mavrogiannopoulos
Re: [TLS] Encryption of TLS 1.3 content type Yoav Nir
Re: [TLS] Encryption of TLS 1.3 content type Daniel Kahn Gillmor
Re: [TLS] Encryption of TLS 1.3 content type Martin Rex
Re: [TLS] Encryption of TLS 1.3 content type Colm MacCárthaigh
Re: [TLS] Encryption of TLS 1.3 content type Nikos Mavrogiannopoulos
Re: [TLS] Encryption of TLS 1.3 content type Daniel Kahn Gillmor
Re: [TLS] Encryption of TLS 1.3 content type Nikos Mavrogiannopoulos
Re: [TLS] Encryption of TLS 1.3 content type Viktor Dukhovni
Re: [TLS] Encryption of TLS 1.3 content type Brian Sniffen
Re: [TLS] Encryption of TLS 1.3 content type Stephen Farrell
Re: [TLS] Encryption of TLS 1.3 content type Michael StJohns
Re: [TLS] Encryption of TLS 1.3 content type Yoav Nir
Re: [TLS] Encryption of TLS 1.3 content type Colm MacCárthaigh
Re: [TLS] Encryption of TLS 1.3 content type Eric Rescorla
Re: [TLS] Encryption of TLS 1.3 content type Andy Lutomirski
Re: [TLS] Encryption of TLS 1.3 content type Peter Gutmann
Re: [TLS] Encryption of TLS 1.3 content type Alfredo Pironti
Re: [TLS] Encryption of TLS 1.3 content type Martin Rex
Re: [TLS] Encryption of TLS 1.3 content type Alfredo Pironti