Subject: Re: WG Review: Open Pluggable Edge Services (opes)

From: Keith Moore <[email-masked]>
Date: Tue, 19 Jun 2001 15:35:14 -0400

Christian,

reducing the overhead of TLS is certainly a laudable goal.  but I don't 
think that IETF should legitimize modification of content by unauthorized 
intermediaries even if it is possible to reduce the overhead of TLS.

Keith

---

From: "Christian Huitema" <[email-masked]>
Date: Tue, 19 Jun 2001 12:27:57 -0700

Keith,

Either the publishers care, or they don't. If they don't, we can sing
"end-to-end" until we are blue in the face, but that will do little to
stop business plans and other "value added" services. If they do, they
are faced with the trade-off that you describe, increase the publishing
cost or surrender control of the content to intermediaries. The best the
IETF can do is to ease that trade-off, by reducing as much as possible
the cost of TLS. 

Reducing the cost of TLS is actually a very achievable goal. The
components of that cost are key negotiation and encryption. Encryption
using RC4 is generally considered adequate and cheap; it certainly
achieves the objective of thwarting putative value-adding proxies. If
keys could be negotiated easily, then we would have come a long way
towards generalizing the use of encryption.

-- Christian Huitema

> -----Original Message-----
> From: Keith Moore [mailto:[email-masked]]
> Sent: Tuesday, June 19, 2001 12:20 PM
> To: Christian Huitema
> Cc: Brian E Carpenter; Maciocco, Christian; Mark Nottingham; Daniel
Senie;
> Scott Brim; [email-masked]
> Subject: Re: WG Review: Open Pluggable Edge Services (opes)
> 
> > What about option 4, "information publishers who don't like
interference
> > by transport providers use TLS/SSL to enforce actual end-to-end
> > transmission of the content" ? As we gain experience in implementing
> > TLS, this is a certainly a possibility!
> 
> so we increase the burden on publishers who want content integrity in
the
> name of decreasing the burden on intermediaries who want to corrupt
> content?
> 
> somehow that doesn't seem like a socially beneficial tradeoff.
> 
> Keith

---

From: Bill Sommerfeld <[email-masked]>
Date: Tue, 19 Jun 2001 20:32:34 -0400

> towards generalizing the use of encryption.

Let's head off this misinformation sooner rather than later.

Encryption algorithms in general, and stream ciphers like rc4 in
particular, do not provide *any* protection against modification; rc4
is merely is a fast way to turn a secret key into a pseudo-random
bitstream which can then be xor'ed with the message to obscure its
content.

This makes it hard for a modifier to know what was changed or what it
was changed to, but an attacker can still toggle bits at known offsets
within the message, which may be sufficient to cause a predictable
change to the message as seen by the recipient.

Fortunately, TLS typically combines a cipher (such as RC4 or 3DES)
with a message authentication code (like HMAC-MD5) which *does* detect
modifications.  If the issue is only protection against an uninvited
mangler-in-the-middle, you could do TLS with the null cipher and pay
only the cost of the HMAC computation.

					- Bill