On Sat, Jul 15, 2017 at 07:48:25AM +0000, Dobbins, Roland wrote: > > > > On Jul 15, 2017, at 13:26, Daniel Kahn Gillmor <d...@fifthhorseman.net> > > wrote: > > > > (b) we know that network capture is widely used adversarially by the > > kinds of attackers that TLS is explicitly intended to defend > > against? > > Because we know that network capture is an absolute, unquestionable > requirement in order to defeat adversaries who are both prevalent > & who can actually be defeated.
s/we know/I believe/ You seem to think that more data is better. Except collecting more data will drive up background. And if you have high background, even common events will just blend in and be missed completely, or are detected with very poor efficiency. Have big enough backgrounds, and one can have estimated over one million events of certain interesting kind in one year, _while_ taking data, but not able to be reasonbly sure that even a single event of the kind occured. And that's while people specifically looking for events of that kind. OTOH, with small backgrounds, even very small amount of events will really stand out. With really small backgrounds, even _one_ event will stand out. > There's no talk of 'privileging' anything. The talk is about not > arbitrarily depriving network administrators & security personnel of > the tools & techniques they've been using for many years and with > great success to troubleshoot & defend their networks, applications, > services, & data. You mean using security problems, that are exploited for bad ends too, in past versions of TLS? E.g. using various problems in session tickets and RSA key exchange? Oh, and like any backdoor, this backdoor too has variety of security problems. And your adversaries would absolutely love to be able to exploit _you_ using these problems, as that would make their lives much easier. -Ilari _______________________________________________ TLS mailing list TLS@ietf.org https://www.ietf.org/mailman/listinfo/tls
