Subject: Blog: Strengthening Internet Security and Accommodating Data Center Requirements: Finding a Path Forward

From: Kathleen Moriarty <[email-masked]>
Date: Mon, 18 Sep 2017 11:13:14 -0400

Dear all:

The following blog has just been posted and is intended to spur
helpful conversations on end-to-end security with TLS 1.3 and
enterprise network monitoring.  There may be alternate paths forward
from what has been discussed or proposed to date, as such I'd like to
encourage some out-of the box thinking and conversation.  It's
important to work through obstacles to deployment when change has an
impact.  With any new protocol or protocol update, we'd like to see
widespread adoption, how do we get there?

Thanks in advance!

https://www.ietf.org/blog/2017/09/internet-security-data-center-reqs/

-- 

Best regards,
Kathleen

---

From: Randy Bush <[email-masked]>
Date: Sat, 23 Sep 2017 14:28:07 +0900

while the datacenter example is somewhat real, 95% of the iceberg is
under the water; vendors wanting to sell a lot of surveillance gear to,
not only enterprises, but repressive regimes.  it is a big and very
dirty (peoole being dragged away in the middle of the night) business.

please keep 1.3 as e2e secure as possible.

randy

---

From: Kathleen Moriarty <[email-masked]>
Date: Sat, 23 Sep 2017 06:45:56 -0400

Thanks, Randy.  I agree and am hoping other ways forward can be found.  I put a similar blog up on RSA's site, but it gave a few reasons why IPsec might be an option within the data center for that use case, suggesting transport mode for a few reasons.  The go forward could be something else, but it would be good for people to think about options until we have better logging at the end point applications and other measures to fill the gaps.  I know opinions on this are all over the map, so we'll have to see what the community wants, but I'm hoping for more options.

Best regards,
Kathleen 

Sent from my iPhone

> On Sep 23, 2017, at 1:28 AM, Randy Bush <[email-masked]> wrote:
>