Re: [tsvwg] [saag] TSVWG WGLC: draft-ietf-tsvwg-transport-encrypt-08, closes 23 October 2019

[Gorry Fairhurst <[e-mail]>]

On 09/10/2019, 16:25, Joe Touch wrote:
>
>> On Oct 9, 2019, at 8:12 AM, Gorry Fairhurst<[e-mail]>  wrote:
>>
>> On 09/10/2019, 15:38, Joe Touch wrote:
>>> +1
>>>
>>> IMO, this isn’t a “tussle” so much as “I really want to do something I know I shouldn’t be doing”.
>>>
>>> A lot of what transport security prevents is - from the middlebox view - a problem.
>>>
>>> For many of us users, preventing middleboxes from doing things like hijacking web, email, and DNS is *exactly* the protection we were seeking.
>>>
>> I do not understand this particular comment with respect to this document: How does "hijacking web, email, and DNS" relate to whether transport headers are encrypted or not? I would have expected a comment like this had the document been talking about transport payload (e.g. whether to use TLS).
>>
>> Could you point me at some text that leads you to think the transport header encryption impacts application hi-jacking ?
> The doc mentions IPsec (encryption the transport headers and payload), TCP AO (authenticating the header and contents), and TLS/DTLS (authenticating contents based on headers).
>
> Any of these prevent HTTP from being hijacked and redirected, e.g., as can occur on public WiFi. IMO,
So, in this respect we agree - but where did the text say otherwise?
> DTLS or DNS over TCP with TLS would protect against DNS hijacking.
Again, we agree, which text do you think needs improved.
> Encrypted is only one part of the equation; authenticated is another (TLS/DTLS doesn’t encrypt headers). But all of these help protect against hijacking.
>
> I’m supporting Christian’s position - the doc is too biased towards “intermediate boxes have rights” than “endpoint users have rights”.
>
> Joe
Gorry