It's possible to run TLS 1.3 and PFS through the Content Delivery Network and into the enterprise data center, and then have a load balancer or other proxy terminate TLS. This gives us the option of running a different protocol in the data center, but we need a better option than TLS 1.2 that will, perhaps sooner than we might expect, be deprecated.
-Andrew -----Original Message----- From: Yaron Sheffer [mailto:yaronf.i...@gmail.com] Sent: Friday, September 23, 2016 3:52 PM To: BITS Security <bitssecur...@fsroundtable.org>; Watson Ladd <watsonbl...@gmail.com>; Ackermann, Michael <mackerm...@bcbsm.com> Cc: tls@ietf.org Subject: Re: [TLS] Industry Concerns about TLS 1.3 You are implicitly suggesting to remove perfect-forward-secrecy as soon as a TLS flow is created by the CDN. However these packets will still be traveling over the public Internet and/or "private" (leased, not really private) MPLS VPNs, where we KNOW that government agencies are eavesdropping and recording network flows to keep for years ahead. In other words, even when the TLS flow enters "your" network, you and your customer are still at risk from pervasive monitoring. Thanks, Yaron _______________________________________________ TLS mailing list TLS@ietf.org https://www.ietf.org/mailman/listinfo/tls
