Re: [TLS] TLS Proxy Server Extension

[Peter Gutmann <[e-mail]>]

Ken Peirce <[e-mail]> writes:

>TLS is used by people to insure end to end integrity and privacy, usually,
>with PKI. Users are protected from intermediate parties if the system
>architects and TLS management by the controlling application have correctly
>handled the design of the PKI

Exactly.  The whole point of TLS is to provide a secured tunnel from source to
destination, which includes defence against MITMs.  If someone wants to do a
MITM, violating a principal design feature of the protocol, then that's their
problem, and not TLS's.  

>IMHO, this is not a protocol issue. It is a systems engineering exercise in
>trust relationships.

Exactly.  The response to this is "don't do that, then", not "we'll completely
break our protocol to make it do the crazy stuff you want".

(If people really want to deploy MITM boxes, put a wildcard cert on the MITM.
That's how cellphone gateways have been doing it for years).

Peter.