Re: [kitten] draft-hansen-scram-sha256 and incorporating session hashing for channel binding

[Nico Williams <[e-mail]>]

On Tue, May 26, 2015 at 06:23:57PM -0400, Tony Hansen wrote:
> On 5/23/15 10:27 AM, Simon Josefsson wrote:
> > ...
> > This text has nothing to do with the tls-session-hash issue? 
> 
> Sorry, it has the text I added because of earlier issues brought up
> within this thread. No, it doesn't address tls-session-hash.
> 
> > If you don't want to ship a known insecure protocol, I believe the
> > options are to either include text similar to what I proposed above,
> > or to replace tls-unique with a secure TLS channel binding (e.g.,
> > draft-josefsson-sasl-tls-cb). Shipping a known insecure protocol is
> > another option, but then you should add a security consideration
> > explaining that tls-unique is not secure without tls-session-hash and
> > that consistency with (the also insecure) RFC 5802 was deemed more
> > important security.
> 
> Your suggested text is:
> 
>     "To be secure SCRAM-SHA-256-PLUS has to be used over a TLS channel
> that MUST have [TLS-SESSION-HASH] negotiated."

That is fine, though I'd add "or session resumption MUST NOT have been
used".

> You then go on to say: "Personally, I would prefer to change to another
> mandatory channel binding that is secure for all TLS versions."

This is not really appropriate here because it's the applications that
need to do this, and we can't say anything here about this that will
force them to.  But we can repeat what should be security considerations
elsewhere, especially since there's currently no RFC providing this
particular security consideration.  A reference to TLS-SESSION-HASH of
the same level (i.e., normative or informative) as RFCs 5246 and 5929
would be nice.

Nico
--