[Lurk] Issue with draft-mglt-lurk-tls12-01

"Scott Fluhrer (sfluhrer)" <sfluhrer@cisco.com> Mon, 22 July 2019 15:43 UTC

Return-Path: <sfluhrer@cisco.com>
X-Original-To: lurk@ietfa.amsl.com
Delivered-To: lurk@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2BABA120274 for <lurk@ietfa.amsl.com>; Mon, 22 Jul 2019 08:43:49 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -14.5
X-Spam-Level:
X-Spam-Status: No, score=-14.5 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com header.b=d2F/XYJM; dkim=pass (1024-bit key) header.d=cisco.onmicrosoft.com header.b=VJUKAy1z
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id CziNaLD6v0-5 for <lurk@ietfa.amsl.com>; Mon, 22 Jul 2019 08:43:46 -0700 (PDT)
Received: from rcdn-iport-1.cisco.com (rcdn-iport-1.cisco.com [173.37.86.72]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A064312013B for <lurk@ietf.org>; Mon, 22 Jul 2019 08:43:46 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=10438; q=dns/txt; s=iport; t=1563810226; x=1565019826; h=from:to:subject:date:message-id:mime-version; bh=BZ5+j2Gib/nUJV+qUXLCtKlfpNb82cxAtJVNSQU/1/k=; b=d2F/XYJMhSb7PHl2vE8nkncAF5Kgonq2LzqA2UYZnUjG3i5M65Y/y9qq ogiig6TO2UnaAHm9T8BR6754n15xZHtmAmeQeuB40yM2/np6+wUjgHkDW kJwa45LIDTLHKp5SeTseLQwqLPEVEwGywYj96Qe5nq7dv5UkO/wundWi6 g=;
IronPort-PHdr: =?us-ascii?q?9a23=3A2Gm6MxxTXhcllMPXCy+N+z0EezQntrPoPwUc9p?= =?us-ascii?q?sgjfdUf7+++4j5YhWN/u1j2VnOW4iTq+lJjebbqejBYSQB+t7A1RJKa5lQT1?= =?us-ascii?q?kAgMQSkRYnBZueB0nmLOTndQQxHd9JUxlu+HToeUU=3D?=
X-IronPort-Anti-Spam-Filtered: true
X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0BsAAAd2TVd/5JdJa1mHQEBBQEHBQG?= =?us-ascii?q?BUwgBCwGBFC9QA21VIAQLKgqHWgOEUokrTJUKhFWBLoEkA1QJAQEBDAEBLQI?= =?us-ascii?q?BAYRAAoJjIzQJDgEDAQEEAQECAQZthR4BC4VjGxMBATgRAYEAJgEEGxqDAYE?= =?us-ascii?q?dTQMdAaA1AoE4iGCCI4J5AQEFhQUYghMJgTQBi14XgUA/gVeCF4UhGIM7gia?= =?us-ascii?q?TdpZxCQKCGQOLQ4hhmAqNNZdQAgQCBAUCDgEBBYFQOIFYcBWDJ4JCCxiDTop?= =?us-ascii?q?TcoEpjVABgSABAQ?=
X-IronPort-AV: E=Sophos;i="5.64,295,1559520000"; d="scan'208,217";a="599803103"
Received: from rcdn-core-10.cisco.com ([173.37.93.146]) by rcdn-iport-1.cisco.com with ESMTP/TLS/DHE-RSA-SEED-SHA; 22 Jul 2019 15:43:44 +0000
Received: from XCH-ALN-014.cisco.com (xch-aln-014.cisco.com [173.36.7.24]) by rcdn-core-10.cisco.com (8.15.2/8.15.2) with ESMTPS id x6MFhiEr023583 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=FAIL) for <lurk@ietf.org>; Mon, 22 Jul 2019 15:43:44 GMT
Received: from xhs-aln-002.cisco.com (173.37.135.119) by XCH-ALN-014.cisco.com (173.36.7.24) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Mon, 22 Jul 2019 10:43:43 -0500
Received: from xhs-aln-003.cisco.com (173.37.135.120) by xhs-aln-002.cisco.com (173.37.135.119) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Mon, 22 Jul 2019 10:43:43 -0500
Received: from NAM04-CO1-obe.outbound.protection.outlook.com (173.37.151.57) by xhs-aln-003.cisco.com (173.37.135.120) with Microsoft SMTP Server (TLS) id 15.0.1473.3 via Frontend Transport; Mon, 22 Jul 2019 10:43:43 -0500
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=n12nGsUWFbDCJSyHA9rIP/ltJIp+G+uA7WP88/gTTA+qzQhKy9i8qHBDO2MychH/k3js4vBVyb3zuM8+m2uhqmGaEviy2EbNjalBXn62kr/3rNt01S099m+QY3ODDIYJpC8h6yyMvVpW7ksMwF0KSr0mJ1Pp75cVioUju1tggThv6H4pVf7tqF5DiGzy80fuA3swWvFYDekkkje+GHmt6kUe5cgmLtopu4JaZU4Qvytz6UaMmaarpVbHb1VDuqxE7KxrGUea8aMRGBGNswzETq3sxEQug75Jo6SllX19S+L13Xu46TAun+TUHW32WZyNPZl3k1AUc/7NoDwr/ZVG4Q==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=NBIPqPE1ara1s8AYgtrmlEP0xKAljcTdd3AzOmUwegU=; b=ZJxvv8zcHQD5MT2QC5EcuR2Me9R89q1mIBfLCXz9jRc2BzpBFUQmW4Ypo2VqSHGssF1aJuWxlGhIX5pCd64MuPI2LcnTDOTBkHXjRUpvpBFzY/YGT4b2XV8DtYrLAuI+q8bvF57XWv59tSdyRlwT4yMU3Vn5/zmbltuJspHlvyLRgjXrshQ4gTpDEqOKFfFfRoMck0selyOQtMBVqT6qbaKcYgmXGFd5VybbyEEFTDrjOX5MW4GDmjAwpxvB8WKtXJSxhHEZ7rTY+YIhV7IpzeJ7onmj5rG/1GaEyZtVLdhcYuHWq8kGa4J+nNt9dDyYwyEqEJ+FT3uA2w4QnYQknA==
ARC-Authentication-Results: i=1; mx.microsoft.com 1;spf=pass smtp.mailfrom=cisco.com;dmarc=pass action=none header.from=cisco.com;dkim=pass header.d=cisco.com;arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.onmicrosoft.com; s=selector2-cisco-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=NBIPqPE1ara1s8AYgtrmlEP0xKAljcTdd3AzOmUwegU=; b=VJUKAy1zagQXXNbxIKPMDCeu0R5SCcEfinVDRhCND8CZPS5zg9+W4KBY9pFS+teREncg5R+YIFH16mkSGpIUBd8b50LSYzVX2QLL5Nj2OCr3aOqiOSjSPDtQ1MmHrQP3LeGsMXPGufoPxqn8zuX9TI8b3dupsp6oU8xAO+nx3Nk=
Received: from MN2PR11MB3871.namprd11.prod.outlook.com (10.255.180.204) by MN2PR11MB4157.namprd11.prod.outlook.com (20.179.150.223) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2094.16; Mon, 22 Jul 2019 15:43:40 +0000
Received: from MN2PR11MB3871.namprd11.prod.outlook.com ([fe80::4c5:965:c7b7:387b]) by MN2PR11MB3871.namprd11.prod.outlook.com ([fe80::4c5:965:c7b7:387b%3]) with mapi id 15.20.2094.013; Mon, 22 Jul 2019 15:43:40 +0000
From: "Scott Fluhrer (sfluhrer)" <sfluhrer@cisco.com>
To: "lurk@ietf.org" <lurk@ietf.org>
Thread-Topic: Issue with draft-mglt-lurk-tls12-01
Thread-Index: AdVAn0hmZaaCYwN1SoGYfRlRp+GHOw==
Date: Mon, 22 Jul 2019 15:43:40 +0000
Message-ID: <MN2PR11MB38718A55BB9A81A752A9CB77C1C40@MN2PR11MB3871.namprd11.prod.outlook.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
authentication-results: spf=none (sender IP is ) smtp.mailfrom=sfluhrer@cisco.com;
x-originating-ip: [173.38.117.85]
x-ms-publictraffictype: Email
x-ms-office365-filtering-correlation-id: 56c627de-8131-4f4c-6cd4-08d70ebb5eb9
x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600148)(711020)(4605104)(1401327)(2017052603328)(7193020); SRVR:MN2PR11MB4157;
x-ms-traffictypediagnostic: MN2PR11MB4157:
x-ms-exchange-purlcount: 2
x-microsoft-antispam-prvs: <MN2PR11MB4157444819E2FC1A1CDB33F1C1C40@MN2PR11MB4157.namprd11.prod.outlook.com>
x-ms-oob-tlc-oobclassifiers: OLM:5797;
x-forefront-prvs: 01068D0A20
x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(4636009)(366004)(376002)(346002)(39860400002)(396003)(136003)(199004)(189003)(66066001)(316002)(7736002)(74316002)(6436002)(2501003)(2906002)(256004)(5640700003)(86362001)(102836004)(2351001)(26005)(6916009)(486006)(186003)(99286004)(6506007)(476003)(478600001)(25786009)(33656002)(7696005)(14444005)(6116002)(790700001)(8676002)(66446008)(3846002)(64756008)(14454004)(66476007)(8936002)(52536014)(66946007)(66556008)(76116006)(81166006)(81156014)(5660300002)(1730700003)(55016002)(53936002)(68736007)(71190400001)(71200400001)(9686003)(54896002)(6306002); DIR:OUT; SFP:1101; SCL:1; SRVR:MN2PR11MB4157; H:MN2PR11MB3871.namprd11.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1;
received-spf: None (protection.outlook.com: cisco.com does not designate permitted sender hosts)
x-ms-exchange-senderadcheck: 1
x-microsoft-antispam-message-info: Mx8mes76++ddBjbsk/0ZCxwiUH0iHZMNJwDCH0nPEbYgXB6s43H+WCXeGOxnc73fHJ6LSy2lnr8H+wD2uD1nrIyJEBQu9pxlHoj2A0obzAx14Z6ly1FCW4rK2TtHVGBeR+E3fYLQnUVhyDUoVPUjlewni2q1Q2VubtQyJEfFfBe2vW68Bg1Krq1EYwkVi4te6mr7CU16DcdFmHIJPlKBepeNvqZX23G+HxUhTowPVyDQvC0annkpkkvFkYpkbrkfpj4X1BwWBPOBWhvh0KnwCEPuvdZrnfwo0lkI0t8T5BTbtWXMosKQwJextm57LHzh0pMshIVOlNyssS14gs+MRACEDVTLpBpn3/3cJ75WNAyL68YN3KxcnSH914Ghye6FXePzQF/+z6ZfG71+I9liyT6UkMncEcflwPLg0lK2y6E=
Content-Type: multipart/alternative; boundary="_000_MN2PR11MB38718A55BB9A81A752A9CB77C1C40MN2PR11MB3871namp_"
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-Network-Message-Id: 56c627de-8131-4f4c-6cd4-08d70ebb5eb9
X-MS-Exchange-CrossTenant-originalarrivaltime: 22 Jul 2019 15:43:40.5748 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 5ae1af62-9505-4097-a69a-c1553ef7840e
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: sfluhrer@cisco.com
X-MS-Exchange-Transport-CrossTenantHeadersStamped: MN2PR11MB4157
X-OriginatorOrg: cisco.com
X-Outbound-SMTP-Client: 173.36.7.24, xch-aln-014.cisco.com
X-Outbound-Node: rcdn-core-10.cisco.com
Archived-At: <https://mailarchive.ietf.org/arch/msg/lurk/bnuFhBa3eaOGYaxyGMuvSavCwlY>
Subject: [Lurk] Issue with draft-mglt-lurk-tls12-01
X-BeenThere: lurk@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Limited Use of Remote Keys <lurk.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/lurk>, <mailto:lurk-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/lurk/>
List-Post: <mailto:lurk@ietf.org>
List-Help: <mailto:lurk-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/lurk>, <mailto:lurk-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 22 Jul 2019 15:43:49 -0000

It would appear that the Proof of Ownership listed in section 6.1 of the draft doesn't work, in the sense that someone without knowledge of the value b can still generate a valid proof.

Here is how he would do that:

  *   We assume that the putative client knows the value bG (the public key), base and ecdhe_params; we assume that he does not know b.
  *   The client computes c = poo_prf ( base + ecdhe_params + "tls12 poo")
  *   The client picks an arbitrary elliptic curve point R, and computes the point T = c(bG) + R.
  *   The client places R (as his supposed rG value) and T (as his supposed tG value) in poo_params, and bG in the ecdhe_params.

Then, the server computes c(bG) + rG; that is, c(bG) + R (for the client-provided R).  He then compares that to tG (that is, the client-provided T).  Of course, this will pass (the client picked T to make this happen), and so the server will believe that the prover knows b, when he doesn't.

Now, I don't know lurk, and so I have no idea what sort of vulnerability this would allow.  However, if you have a 'proof of possession', it should be an actual proof...

One way to fix this is to use a more normal Schnorr proof of knowledge:


  *   We assume a hash function h( X + base + ecdhe_params + "tls12 poo" ), where X is an elliptic curve point and returns a value between 1 and q-1, where q is the order of the curve; below, I'll summarize this as h(X)
  *   The client selects a random value 1 (between 1 and q-1 - it must be chosen uniformly), and computes:
     *   R = rG
     *   t = bh(R) + r mod q
The client sends the point R and the value t in the poo_parameters, and the value bG in the ecdhe_params.

  *   The server computes the points tG and bH(R)G + R; and compares them - it accepts the proof of ownership if they are the same point.