Re: [Uta] Proposed definition of opportunistic encryption using TLS: draft-hoffman-uta-opportunistic-tls-00.txt

[Paul Hoffman <[e-mail]>]

On Feb 3, 2014, at 9:29 AM, Daniel Kahn Gillmor <[e-mail]> wrote:

> Opportunistic encryption as declared by the draft is encryption that
> *will* fail against an active attacker or MiTM.  

Nope. Opportunistic encryption using TLS, as it is defined in the -00 draft, will work just fine with an MITM.

The second paragraph of Section 2 is:

   When an application that supports opportunistic encryption negotiates
   TLS, that application might or might not authenticate the TLS server.
   It is expected that the common case is that applications that
   supports opportunistic encryption will not authenticate the TLS
   servers they connect to.  However, it is acceptable for an
   application that supports opportunistic encryption to only complete
   the TLS negotiation if the TLS server can be validated.

So, it *might* fail against an active attacker or an MITM, but only if the application does what is described in the third sentence. The large expectation is that developers will do what it says in the second sentence, namely continue without authentication.

> It would be bad for the
> 'net if our tools were to indicate that MiTM-able connections are
> "secure" using the same UI as non-MiTM-able connections.

That's true, but it is also different than "failing".

If the WG adopts the draft and wants to change the definition, of course it can. But the current definition absolutely allows the opportunistic client to ignore the server's authentication information in order to help prevent a passive snooper from seeing the traffic.

--Paul Hoffman