Encryption backdoors have been in the news quite a bit lately<\/a>. And not for the right reasons. As politicians and law enforcement officials call for \u201cresponsible\u201d encryption, one group close to the finalization of the new TLS 1.3 standard is attempting to make them a reality.<\/p>\n BITS, the technology policy division of the financial services roundtable, which represents over 100 of the top US financial organizations, is pushing a TLS 1.3 proposal that lists an \u201coption for negotiation of visibility in the datacenter<\/a>.\u201d<\/span><\/p>\n Opponents of this proposal call it an intentional weakness. Some even refer to it as a backdoor, the argument being that it leaves the wider internet in danger of unauthorized decryption.<\/p>\n While the banks say that they need the ability to decrypt connections in their enterprise networks in order to stay in compliance with their own regulations, others are quick to point out that there are alternatives to weakening the TLS protocol across the entire internet.<\/p>\n \u201cThe bank industry is pushing the TLS working group to create a decryption option as part of the specification, and of course the tech sector is saying \u2018That\u2019s not going to happen,\u2019 \u201d Janet Jones, a Microsoft senior security program manager, told CyberScoop<\/a>. \u201cCan you imagine us supporting something that gave an API with a decrypt button? We can\u2019t do that.\u201d<\/p><\/blockquote>\n TLS 1.3 is currently in the final stages before it becomes an official standard. Currently, the final details are being hammered out before the protocol is likely to be finalized later this month when the Internet Engineering Task Force (IETF) meets.<\/p>\n For those that aren\u2019t regular readers, TLS 1.3 is the next version of the TLS protocol that facilitates encryption on the internet.<\/p>\n The TLS protocol is the successor to the SSL protocol. While colloquially we refer to the technology as SSL, it is actually TLS or Transport Layer Security now. I won\u2019t bore you with a complete version history, but SSL 1.0 and 2.0 never really made it off the ground. SSL 3.0 was quickly replaced by TLS 1.0, then 1.1 and 1.2. The internet is currently stuck between 1.1 and 1.2 as of right now. TLS 1.3 promises better performance than its predecessors as well as a streamlined handshake.<\/p>\n However, all of that would be rendered fairly moot if the financial sector gets its way and a backdoor is included.<\/p>\n \u201cWe went to the banks and said there are ways to do what you want to do,\u201d said Jones, who is also the vice chair of the tech industry\u2019s Messaging, Malware and Mobile Anti-Abuse Working Group. \u201cBut you need to build that appliance on your own. I\u2019m not going to build a decryption feature in. If I did, I might as well quit my job.\u201d<\/p><\/blockquote>\n\n