Re: [Cfrg] Help with the use of contexts

[Ilari Liusvaara <[e-mail]>]

On Tue, Jan 17, 2017 at 11:41:54PM +0200, Yaron Sheffer wrote:
> On 17/01/17 18:12, Adam Langley wrote:
> >On Tue, Jan 17, 2017 at 3:31 AM, Yaron Sheffer <[e-mail]> wrote:
> >>Wide industry adoption of TLS 1.2 took around 10 years. So IMO saying "this
> >>is solved in TLS 1.3" is not a good enough answer, if in the meantime we
> >>will continue to see cross-protocol and cross-TLS-version attacks.
> >
> >If there are such attacks then they'll continue to be a problem for
> >TLS 1.2 because only the Ed* schemes have the possibility of a context
> >string. For ECDSA and RSA, the context still needs to be included in
> >the signed message somehow. So TLS 1.2 needs a larger change than
> >wiring up the context inputs of the Ed* schemes if you want to protect
> >it anyway.
> 
> Correct, but this would still eliminate cross-version attacks between TLS
> 1.3 and TLS <= 1.2, for Ed*. In other words, there is (incremental) value in
> adding context opportunistically.

TLS 1.3 server/client signatures are designed to resist confusion to
SSL 3.0 - TLS 1.2 signatures[1] anyway..


[1] There's the confusion possibility with RSA key exchange, but one
really can't do much about that (other than banning all present RSA
keys, but that would be infeasible)..


-Ilari