Subject: [TLS] TLS and middleboxes again

From: Yoav Nir <[email-masked]>
Date: Thu, 25 Aug 2011 10:39:57 +0300

Hi all

Several weeks ago, Dave McGrew submitted a draft for improving the workings of TLS proxies. As expected, this generated a lot of controversy, with some people saying that they'd rather hand over the session keys to the middlebox than to standardize a MitM attack.

I was on the other side of that debate, but one problem with comparing the two alternatives is that for proxies there are several commercial products and Dave's draft, while there's nothing for key sharing. To remedy that, and help the discussion along, I've submitted the below draft. Comments and additional controversy are very welcome.

Yoav

Begin forwarded message:

> From: "[email-masked]" <[email-masked]>
> Date: August 25, 2011 10:30:46 AM GMT+03:00
> To: "[email-masked]" <[email-masked]>
> Subject: I-D Action: draft-nir-tls-keyshare-00.txt
> Reply-To: "[email-masked]" <[email-masked]>
> 
> A New Internet-Draft is available from the on-line Internet-Drafts directories.
> 
> 	Title           : A Method for Sharing Record Protocol Keys with a Middlebox in TLS
> 	Author(s)       : Yoav Nir
> 	Filename        : draft-nir-tls-keyshare-00.txt
> 	Pages           : 11
> 	Date            : 2011-08-25
> 
>   This document contains a straw man proposal for a method for sharing
>   symmetric session keys between a TLS client and a middlebox, so that
>   the middlebox can decrypt the TLS-protected traffic.
> 
>   This method is an alternative to the middlebox becoming a proxy.
> 
> 
> A URL for this Internet-Draft is:
> http://www.ietf.org/internet-drafts/draft-nir-tls-keyshare-00.txt

---

From: Chris Richardson <[email-masked]>
Date: Tue, 30 Aug 2011 10:58:22 -0400

If the middlebox is inserting KeyShareInfo records into the stream,
then it must modify the TCP sequence number on all future packets in
the handshake.  One cannot use a "dumb" middlebox that modifies the
handshakes and nothing more.

Perhaps an out-of-band keysharing mechanism would be better.

On Thu, Aug 25, 2011 at 3:39 AM, Yoav Nir <[email-masked]> wrote:
> _______________________________________________
> TLS mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/tls
>

---

From: Yoav Nir <[email-masked]>
Date: Wed, 31 Aug 2011 14:57:51 +0300

The middlebox would still have to at least delay application records until the keys are delivered. Also, making sure that the keys are actually delivered to the middlebox reliably is extremely hard unless we use the existing connection. 

I just don't see an out-of-band delivery as being workable.

If we could eliminate the records that the middlebox inserts, and have only the client and server send records, I agree that it would be better, but without the middlebox announcing its presence, I don't see how the protocol could work without too much key sharing. I'll be glad to get some suggestions.

Yoav