Subject: Re: [saag] looking to hold a TLS VPN side meeting at IETF 92

From: "Boyle, Vincent M" <[email-masked]>
Date: Wed, 18 Mar 2015 20:02:50 +0000

Just a quick update: a colleague of mine and I did some investigating and we think the City Tavern would be a good venue for the side meeting. I'm performing a bit of due diligence to make sure they can accommodate us, but I believe that's where we will meet (unless a Dallas local wants to warn us off). So, 7:30 PM local time at the City Tavern (1402 Main Street, which looks to be a 10 minute walk from the Fairmont). I'll attempt to reserve some space under my name.

Hope to see you there,
Mike

---

From: Peter Gutmann <[email-masked]>
Date: Thu, 19 Mar 2015 06:17:10 +0000

Aaron Zauner <[email-masked]> writes:

>[...]

I think we're both in violent agreement there, the protocol sucks, the spec
sucks (despite heroic efforts by the post-v1 cleanup crew), implementations
suck, and having to deploy it in the field is the sum of the suckage of all of
its parts :-).

>OpenVPN is also not a TLS-only "VPN". An OpenVPN developer told me that
>recent releases do duplexing (mentioned earlier): TLS is used for a control
>channel while the data channel is AES-CBC encrypt-then-mac.

Yeah, it's kind of a swiss-army-chainsaw of getting packets from A to B.  This
again points to a problem in trying to do a spec, if you come up with some
clean, minimal design then it won't do a lot of what OpenVPN (or a lot of
commercial TLS VPNs) do, so it probably won't see much uptake.  OTOH if you
try and make it a swiss-army-chainsaw spec... well, IKEv1 tried that.

In any case though, I'm not really fussed, if people feel like doing a spec
for this, feel free..

Peter.