IETF Logo Mail Archive

Re: [Cfrg] NSA sabotaging crypto standards

Watson Ladd <watsonbladd@gmail.com> Fri, 07 February 2014 16:28 UTC

Return-Path: <watsonbladd@gmail.com>
X-Original-To: cfrg@ietfa.amsl.com
Delivered-To: cfrg@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C6DCC1A0186 for <cfrg@ietfa.amsl.com>; Fri, 7 Feb 2014 08:28:44 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2
X-Spam-Level:
X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id eFja_5uNIASd for <cfrg@ietfa.amsl.com>; Fri, 7 Feb 2014 08:28:42 -0800 (PST)
Received: from mail-wi0-x22b.google.com (mail-wi0-x22b.google.com [IPv6:2a00:1450:400c:c05::22b]) by ietfa.amsl.com (Postfix) with ESMTP id 75E8A1A0193 for <cfrg@irtf.org>; Fri, 7 Feb 2014 08:28:42 -0800 (PST)
Received: by mail-wi0-f171.google.com with SMTP id cc10so1014809wib.4 for <cfrg@irtf.org>; Fri, 07 Feb 2014 08:28:41 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=asmRlDGYpJ5RxctBcV323mUXMmvKpVmz5r+EIKpiTRA=; b=qdU3X9zbXpdwYfibjik4YZi4Ut/NDj6XMs62hvFUNmLWmIfaCsTM44GaPZ0hUzP6Zt tS04cMKTiudbtdG1AQnYhOvJGAt2gyKYX6ysSzPQEaQvhro64JmmqP+p2M6y9NfA6Bpp F3wHE1nREFeUEx3TJndkM2jsHIDwAQvQjZOXLd7TLdoE8mqunffCUDDAkvZQx2jtqVV6 5DXW8JBD4URcsVzgyAKiIzyx0MsX4M7yXxOCk1A9prwGU5OEHjbZKGSn5GPto3oRnqkQ 6t40Bxt/3zF8Zmfgsh0ZlEIiJ4xlxM+8WFAGeJ0qoTY/SUmmbGTygv22R6C4HbQYahU0 kypg==
MIME-Version: 1.0
X-Received: by 10.194.219.132 with SMTP id po4mr11338177wjc.7.1391790521675; Fri, 07 Feb 2014 08:28:41 -0800 (PST)
Received: by 10.194.250.101 with HTTP; Fri, 7 Feb 2014 08:28:41 -0800 (PST)
In-Reply-To: <52F505C6.5020306@gnutls.org>
References: <20140203192451.6268.76511.idtracker@ietfa.amsl.com> <75e1e853dc391b418062ee5e51adeb2f.squirrel@www.trepanning.net> <CABqy+sr7ZKrACj4Ga2_75d9Kea0aKbrp2P5fWWu4YZP53zijxw@mail.gmail.com> <CACsn0cmS152wYQWHiX8ykzaMM=6b=r=fwVuLfPj_u0wmoq0jKw@mail.gmail.com> <7BAC95F5A7E67643AAFB2C31BEE662D018B81B7F7C@SC-VEXCH2.marvell.com> <CACsn0c=a5PvZOZgVRjHaJ2avGCPHF6b6nOpNh+iT0909X-jUFA@mail.gmail.com> <52F23D52.4090509@cisco.com> <EFA9E215-3B01-43C6-A8F0-3F98E3ED2E26@netapp.com> <3E30D764-7E19-45DB-9D6D-63949F5B36CB@netapp.com> <255B9BB34FB7D647A506DC292726F6E1153AE65F2E@WSMSG3153V.srv.dir.telstra.com> <570B8BE5-1362-4D08-A22D-FE86FC4A77DC@netapp.com> <CACsn0ckm95r4x7VBrW81+f7Resf7RcS6iOBPx3yqu9m1VuELhw@mail.gmail.com> <6F8C22FA-B968-4B3C-8A8D-C24F1DFC5021@vpnc.org> <CACsn0cmFpQEBbv=3EWvUff3EnNuuiqyzjJqFR6Dy97VjLREVVg@mail.gmail.com> <c2077ef440412f1158e7bacdfc8f8db7.squirrel@www.trepanning.net> <CACsn0c=G86j-eha6CO1Wigjk8EQOeQoxS8=OX-pbgzn9BYwUUw@mail.gmail.com> <52F505C6.5020306@gnutls.org>
Date: Fri, 07 Feb 2014 08:28:41 -0800
Message-ID: <CACsn0ckOL8xdp5z7DdB9wyHhFpax0DhVXjsUMuGj39HgKk4YBA@mail.gmail.com>
From: Watson Ladd <watsonbladd@gmail.com>
To: Nikos Mavrogiannopoulos <nmav@gnutls.org>
Content-Type: text/plain; charset="UTF-8"
Cc: "cfrg@irtf.org" <cfrg@irtf.org>
Subject: Re: [Cfrg] NSA sabotaging crypto standards
X-BeenThere: cfrg@irtf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Crypto Forum Research Group <cfrg.irtf.org>
List-Unsubscribe: <http://www.irtf.org/mailman/options/cfrg>, <mailto:cfrg-request@irtf.org?subject=unsubscribe>
List-Archive: <http://www.irtf.org/mail-archive/web/cfrg/>
List-Post: <mailto:cfrg@irtf.org>
List-Help: <mailto:cfrg-request@irtf.org?subject=help>
List-Subscribe: <http://www.irtf.org/mailman/listinfo/cfrg>, <mailto:cfrg-request@irtf.org?subject=subscribe>
X-List-Received-Date: Fri, 07 Feb 2014 16:28:45 -0000

On Fri, Feb 7, 2014 at 8:11 AM, Nikos Mavrogiannopoulos <nmav@gnutls.org> wrote:
> On 02/07/2014 04:59 PM, Watson Ladd wrote:
>
>> But let's go into detail about how well the cryptographers did in TLS.
>> In 1995 Phil Rogaway tells everyone to use encrypt-then-MAC.
>
> I believe you are oversimplifying things. Indeed Rogaway suggested
> encrypt-then-MAC, but other cryptographers were suggesting
> MAC-then-Encrypt (authenticate what is meant not what is sent). There
> was also no attack known for MAC-then-encrypt.

Show me one cryptographer who recommended MAC-then-Encrypt.
Also, absence of known attacks is not the same as absence of attacks.
Encrypt-then-MAC was the conservative choice.

>
> In general it is very easy to see the obvious solution 20 years later,
> but the challenge is to properly decide at the right time.

It was obvious then: encrypt-then-MAC was known secure, while
MAC-then-encrypt was not.
Any excuse vanishes with Bellare-Nampare (2000). Of course, even if we
take the best interpretation, the TLS WG frittered away 9 years after
being informed of an attack.

Sincerely,
Watson Ladd
>
> regards,
> Nikos
>
> _______________________________________________
> Cfrg mailing list
> Cfrg@irtf.org
> http://www.irtf.org/mailman/listinfo/cfrg



-- 
"Those who would give up Essential Liberty to purchase a little
Temporary Safety deserve neither  Liberty nor Safety."
-- Benjamin Franklin

v2.23.0 | Report a Bug | By Email