Subject: [IPsec] looking to hold a TLS VPN side meeting at IETF 92

From: "Boyle, Vincent M" <[email-masked]>
Date: Fri, 13 Mar 2015 17:11:29 +0000

Hi all,
                I'm planning to hold a side meeting at IETF 92 to gauge interest in creating a standard for TLS VPNs. One motivating use case for my organization is the need to  protect data between an app on a mobile device and the enterprise network that it connects to.  For many of our customers, a TLS-based solution is preferable to IPSec (perhaps because their vendors support the former). For some sensitive military applications, there is a requirement to provide two layers of encryption, so using TLS for the second layer makes sense. Having each app invoke TLS is problematic because it introduces validation costs for each app before it is deployed (to ensure that it correctly implements TLS or makes the appropriate OS calls). We would prefer the option of validating a TLS VPN product and having it available for use by all apps on the device. To create the necessary validation requirements and test activities, we need to have a standard that we can point to.  The development of an open standard would provide a consistent and fair method of measuring security (using Protection Profiles) which scales to enable the validation and testing of TLS VPNs.

                Beyond this specific (but fairly pressing) use case, we believe that there are many organizations that would benefit from the availability of a standards-based, validated mechanism to protect communications between their mobile devices and the enterprise network.

                Please discuss on the  saag mail list. I will schedule a meeting time at a local drinking establishment for either Monday or Wednesday at 7:30 PM (local Dallas time). I'd appreciate feedback on the meeting times (if you expect to attend) as well as any comment on the usefulness or feasibility of this effort.

Thanks,
Mike Boyle
Standards Lead
Information Assurance Directorate, NSA

---

From: Yoav Nir <[email-masked]>
Date: Sat, 14 Mar 2015 20:21:34 +0200

Hi, Mike

>                 Please discuss on the  saag mail list. I will schedule a meeting time at a local drinking establishment for either Monday or Wednesday at 7:30 PM (local Dallas time). I’d appreciate feedback on the meeting times (if you expect to attend) as well as any comment on the usefulness or feasibility of this effort.

On Wednesday there is going to be a I2NSF side meeting that is likely to attract many of the same people. I would go with Monday.

Yoav

---

From: Michael Richardson <[email-masked]>
Date: Sat, 14 Mar 2015 15:47:49 -0400

I sure hope that you will give us a definition of a TLS VPN.
It's really important that we know what is in scope and what is not.
My take is that solutions that run TCP and/or HTTPS proxy over TLS,
are not TLS VPNs, because they don't pass the "N"etwork part of
VPN.  They are useful mechanisms, and I'm all for standardizing them, but
the word VPN should not be applied.

OpenVPN is a TLS keyed VPN.  It can and does run over a single TCP port, but
that has congestion issues (tcp over tcp), so running the data part it over
UDP is preferrale, but not always possible.
(Meanwhile,there are IPsec vendors that run ESP over TCP in non-standard
fashions...)

I'd like to see some convergence at the dataplane side.

--
Michael Richardson <[email-masked]>, Sandelman Software Works
 -= IPv6 IoT consulting =-