RESCHEDULED: Virtual Workshop on Challenges with Compliance, Operations, and Security with Encrypted Protocols, in Particular TLS 1.3

Friday, September 25, 2020

This workshop was rescheduled from August 13. 

Workshop Objectives

The National Institute of Standards and Technology (NIST) will host a virtual workshop to discuss compliance, operations, and security challenges with modern encrypted protocols on Friday, September 25, 2020. Deployment of these protocols, in particular TLS 1.3, can impact some organizations ability to meet their regulatory, security, and operational requirements. The workshop will investigate the practical and implementable approaches to help those industries adopt them in their private data centers and the hybrid cloud without impacting regulatory compliance, security, or operations. Invitations will be extended to parties that submit brief descriptions of their interest in this topic.

The workshop will identify various approaches and practices to meet common compliance, operations, and security requirements. The findings from this workshop will inform the development of a potential National Cybersecurity Center of Excellence (NCCoE) demonstration project to implement one or more of the proposed approaches while meeting the business use cases, the security capabilities, and supporting technologies. 


The workshop will focus on enterprise data center environments which include on-premise data center and hybrid cloud deployment hosted by a third-party data center or a public cloud provider. The public Internet is out of scope. When enterprises deploy network security protocols within the data center to provide integrity and confidentiality, the amount of encrypted data in the enterprise data center increases, and visibility decreases. Enterprises have traditionally depended upon visibility into data in transit within their networks to implement critical cybersecurity and operational controls (e.g., intrusion detection, malware detection, fraud monitoring, and troubleshooting). These cybersecurity controls support both enterprise security and regulatory requirements. For example, some industries are required to monitor transactions for fraud, a task made more difficult if network traffic cannot be decrypted. In particular, enterprise architectures facilitate comprehensive inspection, collection, and analysis of data (i.e., both enterprise and personal data) through a small number of passive or active monitoring devices. To maintain visibility, these cybersecurity controls are provided with cryptographic keying material needed to decrypt the traffic. However, in many widely deployed protocols, this deviates from the original trust model because the keys needed to decrypt traffic are also used to authenticate the server, making the control devices indistinguishable from the authentic server.

Recent enhancements to these security protocols have made visibility in the enterprise data center more challenging—TLS 1.3 and QUIC are examples. While these protocol enhancements increase performance and address security concerns on the public internet, they also reduce visibility. In addition, emerging deployment models leverage encrypted transport to protect protocols that were previously in the clear (e.g., DoT (DNS over TLS) and DoH (DNS over HTTPS)). DoT and DoH are out of scope for the current project, but may be the subject of future NCCoE work. Enhanced security protocols and deployment models were not designed to accommodate decryption of traffic flows by passive monitoring devices, creating potential compliance, security and operational impacts in enterprises.

Consequently, enterprises have raised questions about how to implement critical services, meet enterprise security, operational, and regulatory requirements, use the enhanced security protocols, and leverage new deployment models all at the same time. Such enterprises may need to consider applying new architectures and novel techniques to augment or replace traditional monitoring devices while satisfying their business, regulatory, and network operations requirements.

NIST invites industry subject matter experts and practitioners to present their views related to challenges to compliance, operations, and security with the modern encrypted protocols, in particular TLS 1.3, as well as proposed solutions. The workshop provides an opportunity for participants to provide feedback on all aspects of the planned activities to include: challenges, impacted protocols, relevant standards, guidelines, recommended practices, use cases and technologies to be considered, and sources of specifications and guidance. NIST will use the resulting prioritized list of activities to develop an NCCoE project to help accelerate the investigation and demonstration of proposed approaches along with their supporting technologies that can be deployed and operated securely by default.

To register for this free workshop by September 25, 2020, please follow this link .

The workshop will be recorded and the content will be made available after the event. Please join the community of interest by sending an email to to get the latest updates on the activities related to Challenges with Compliance, Operations, and Security with Encrypted Protocols.


 12:00 – 12:10

 NIST and NCCoE Overview

 Jeff Greene

 12:10 – 12:25

 Workshop Overview & Background

 Tim Polk

 12:25 – 12:45

 IETF Principles for Encrypted Protocols

 Sean Turner

 12:45 – 12:55

 Moderated Q&A

 Tim Polk

 12:55 – 13:00


 13:00 – 13:15

 Compliance Challenges

 Ralph Poore

 13:15 – 13:30

 Operations Challenges

 Steve Fenter

 13:30 – 13:45

 Security Challenges

 John Banghart

 13:45 – 14:00

 Instructive Scenarios for Demonstration Projects

 Paul Turner

 14:00 – 14:10

 Moderated Q & A

 John Banghart

 14:10 – 14:15


 14:15 – 15:00

 Proposed Approaches

  • Paul Barret
  • Steve Perkins
  • Nancy Cam-Winget

 15:00 – 15:15

 Moderated Q & A

 Russ Housley

 15:15 – 15:30

 Next Steps/Wrap-up

 Curt Barker

Additional Resources

In Fall 2019, NIST participated in an invitational workshop on Enterprise visibility hosted by the Center for Cybersecurity Policy and Law at Venable. The workshop report is available here (


Please send an email to .