Subject: I-D Action: draft-richsalz-httpbis-https-downgrade-01.txt

From: [email-masked]
Date: Sun, 24 Mar 2019 02:34:17 -0700

A New Internet-Draft is available from the on-line Internet-Drafts directories.

        Title           : Best practices for TLS Downgrade
        Authors         : Brian Sniffen
                          Mike Bishop
                          Erik Nygren
                          Rich Salz
	Filename        : draft-richsalz-httpbis-https-downgrade-01.txt
	Pages           : 8
	Date            : 2019-03-24

Abstract:
   Content providers delivering content via CDNs will sometimes deliver
   content over HTTPS (or both HTTPS and HTTP) but configure the CDN to
   pull from the origin over cleartext and unauthenticated HTTP.  From
   the perspective of a client, it appears that their requests and
   associated responses are delivered over HTTPS, while in reality their
   requests are being sent across the network in-the-clear and responses
   are delivered unauthenticated.  This exposes user request data to
   pervasive monitoring [RFC7258]; it also means response data may be
   tampered with by active adversaries.  Terminating TLS connections on
   a load balancer and contacting a backend over cleartext has long been
   common within data centers, but doing this TLS termination and
   downgrade to HTTP at a CDN introduces additional risk when the
   unprotected traffic is sent over the general Internet, sometimes
   across national boundaries.

   While it would be nice to say "never do this," customer demand,
   content provider use-cases, and market forces today make it
   impossible for CDNs to not support downgrade.  However, following a
   set of best practices can provide visibility into when this is
   happening and can reduce some of the risks.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-richsalz-httpbis-https-downgrade/

There are also htmlized versions available at:
https://tools.ietf.org/html/draft-richsalz-httpbis-https-downgrade-01
https://datatracker.ietf.org/doc/html/draft-richsalz-httpbis-https-downgrade-01

A diff from the previous version is available at:
https://www.ietf.org/rfcdiff?url2=draft-richsalz-httpbis-https-downgrade-01

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/