IETF Logo Mail Archive

Re: [Uta] Opportunistic encryption and authentication agility

Trevor Perrin <trevp@trevp.net> Tue, 25 March 2014 23:36 UTC

Return-Path: <trevp@trevp.net>
X-Original-To: uta@ietfa.amsl.com
Delivered-To: uta@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 937AC1A0256 for <uta@ietfa.amsl.com>; Tue, 25 Mar 2014 16:36:07 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.978
X-Spam-Level:
X-Spam-Status: No, score=-1.978 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FM_FORGED_GMAIL=0.622, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qD3u2FWdQAWk for <uta@ietfa.amsl.com>; Tue, 25 Mar 2014 16:36:05 -0700 (PDT)
Received: from mail-wg0-f50.google.com (mail-wg0-f50.google.com [74.125.82.50]) by ietfa.amsl.com (Postfix) with ESMTP id 707E71A0221 for <uta@ietf.org>; Tue, 25 Mar 2014 16:36:05 -0700 (PDT)
Received: by mail-wg0-f50.google.com with SMTP id x13so701324wgg.33 for <uta@ietf.org>; Tue, 25 Mar 2014 16:36:03 -0700 (PDT)
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type; bh=4dtnHWd4Z21a1e5cqCGzFPQu1PH57Hd3iS8shWBf1EA=; b=kLf2R/tpD1DlVgqKwluLJbFTvinC6xxLgFWfWnRv4K8z/cb2mzmfTwggHVdTqdAs8G cv70UlGPbKfPuk2y5PQmmdN5hlmnGuQ9JnpqTHm94S7VHlghEiLenfw9ZVGKx9rmne57 mwpYldiQTjmTSieKzlao51+HciSMC/TSP4c0dLXjpXQ9GjrQH0bTnBmLKdDQwkFdjtn0 CSYlvikx5pfbEWwapo4Om9eOjKSVjCiiEKVJ0nNQmoOWQcCOUDiATIHhYUHvJPmSb8ey TY1oBokL1d9Pp53IfogdVIdEQXjnjDXhhR3mChWt0wcZMuO0ijsWIGiPWlRnsJu5VPy/ hLYg==
X-Gm-Message-State: ALoCoQkmwG+Cj0/au+bnmMFmTClbJR1z/32eYfOMhFABE22LTgv/qEJWTwx07blZaS5yFLgOdx82
MIME-Version: 1.0
X-Received: by 10.180.77.129 with SMTP id s1mr25229315wiw.56.1395790563432; Tue, 25 Mar 2014 16:36:03 -0700 (PDT)
Received: by 10.216.45.146 with HTTP; Tue, 25 Mar 2014 16:36:03 -0700 (PDT)
X-Originating-IP: [184.23.29.222]
In-Reply-To: <CACsn0cnwtxTpYyNK71wi99Vq=8wJQDY8c1ye_19H+py-wD-a1g@mail.gmail.com>
References: <CAGZ8ZG0rBxiE2dGZXhpvhKiyJOu=6Bn8sQ2seJ9_KvgPjmaaRg@mail.gmail.com> <532CFAB0.4070301@network-heretics.com> <10492.1395613933@sandelman.ca> <533042FF.7060603@network-heretics.com> <53305B5D.8030708@fifthhorseman.net> <53305EFD.9030003@network-heretics.com> <53306294.4070205@fifthhorseman.net> <CAGZ8ZG2GYTYfrSDGxEMS3eRsg2g_LaWP_pyHt9vmz4NV2cGAEw@mail.gmail.com> <CAA4WUYhffWpsxU1FrmQ1np1EObaC5EgMC-R7QDj8C0ODTRLPdQ@mail.gmail.com> <CAGZ8ZG0nyfNvpkL2e39Or0W8WVeDXjdcCzPQE-DNjaY2t+j-sw@mail.gmail.com> <CACsn0cnwtxTpYyNK71wi99Vq=8wJQDY8c1ye_19H+py-wD-a1g@mail.gmail.com>
Date: Tue, 25 Mar 2014 16:36:03 -0700
Message-ID: <CAGZ8ZG0+-6CeX4fcukqSL0N1_CF4pzd=99MpC0wOssrfmDspRg@mail.gmail.com>
From: Trevor Perrin <trevp@trevp.net>
To: Watson Ladd <watsonbladd@gmail.com>
Content-Type: text/plain; charset="ISO-8859-1"
Archived-At: http://mailarchive.ietf.org/arch/msg/uta/LuNguwcBaMs7moG5d3ms-vW6xdw
Cc: "uta@ietf.org" <uta@ietf.org>
Subject: Re: [Uta] Opportunistic encryption and authentication agility
X-BeenThere: uta@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: UTA working group mailing list <uta.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/uta>, <mailto:uta-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/uta/>
List-Post: <mailto:uta@ietf.org>
List-Help: <mailto:uta-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/uta>, <mailto:uta-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 25 Mar 2014 23:36:07 -0000

On Tue, Mar 25, 2014 at 4:11 PM, Watson Ladd <watsonbladd@gmail.com> wrote:
> On Tue, Mar 25, 2014 at 4:47 PM, Trevor Perrin <trevp@trevp.net> wrote:
>>
>> Maybe adding other auth methods to HTTP-over-TLS
>> would be best done silently, with no UI unless a security failure
>> occurs?
>
> Sadly this doesn't work. If I can imitate the website because of a
> WebPKI failure, I can pretend to not support whatever additional auth
> is done.

Not necessarily.

Consider pinning - the browser could remember some security policy for
a site, and apply it to future HTTP-over-TLS connections.

Or consider a plugin that performs online lookups to (Convergence /
Perspectives / DNSSEC etc) for HTTP-over-TLS sites, and raises an
error if the site's keys are suspicious, or the lookup server can't be
reached.

These are things that could be built on top of "opportunistic
encryption" for HTTP, so my point is that OE could be about more than
just passive eavesdropping.


Trevor

v2.23.0 | Report a Bug | By Email