Re: [Cfrg] [TLS] 3DES diediedie

[Tony Arcieri <[e-mail]>]

On Tue, Sep 6, 2016 at 4:36 PM, Ira McDonald <[e-mail]>
wrote:

> But I wanted to observe that, after my recent years working in the
> auto security area, there are extreme cost constraints (and power
> constraints) on CPUs in small sensors and smaller auto ECUs.
>
> Cents matter.  Dollars are out-of-the-question.
>

There is definitely a middle ground here: there are 8-bit "secure MCUs"
with crypto accelerators.

Another factor to consider is how severely these devices have previously
failed from a security perspective: attackers pivoting from wireless tire
pressure sensors have been able to move laterally to ECUs, and at that
point are able to do any number of things that could cause a vehicle to
crash:

http://www.winlab.rutgers.edu/~Gruteser/papers/xu_tpms10.pdf

In every other space besides IoT hardware crypto accelerators are the norm.
They have certainly been the norm for the payments industry for decades,
but that's an industry that has much more experience with the risks,
whereas the "Internet of Cars" is relatively new.

I think the automotive industry needs to come to terms with with the fact
that it may need a "security budget", because there are definitely huge
risks that need to be addressed.

One could argue "well then they won't use TLS", which may be true,
> but's it's a dangerous path IMHO.
>

Equally dangerous is deploying TLS insecurely. As an example of what I
consider necessary for security: are they capable of receiving fully
automated security updates? There have been a litany of TLS
vulnerabilities, especially recently, and unless these devices are capable
of these updates they will effectively be "insecure forever". In such a
case people may write off security concerns as "it's protected by TLS", but
they may be vulnerable to a Heartbleed-like attack, or perhaps they're
validating certificates incorrectly ala
https://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf. These vulnerabilities
need to get fixed, or TLS is worthless.

I expect the answer to the "can these devices perform automated software
updates?" to be a resounding no. But if people really want to deploy TLS
successfully and securely for these use cases, that answer needs to change.

Is your 8-bit MCU with no crypto accelerator really up to the challenge?

-- 
Tony Arcieri