Re: [TLS] AES-GCM and ChaCha-Poly1305: how many bytes are safe?
Brian Smith <brian@briansmith.org> Mon, 02 November 2015 19:59 UTC
Return-Path: <brian@briansmith.org>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EAF8E1A011C for <tls@ietfa.amsl.com>; Mon, 2 Nov 2015 11:59:33 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.278
X-Spam-Level:
X-Spam-Status: No, score=-1.278 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, SPF_PASS=-0.001] autolearn=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ZfkDCpWkbiQa for <tls@ietfa.amsl.com>; Mon, 2 Nov 2015 11:59:32 -0800 (PST)
Received: from mail-ob0-x22c.google.com (mail-ob0-x22c.google.com [IPv6:2607:f8b0:4003:c01::22c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AAE5A1A00CE for <tls@ietf.org>; Mon, 2 Nov 2015 11:59:32 -0800 (PST)
Received: by obbwb3 with SMTP id wb3so104152851obb.0 for <tls@ietf.org>; Mon, 02 Nov 2015 11:59:31 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=briansmith_org.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=DZrciXksHlCrg2L8yxlyF9McM97q+xNN21wuF0gO60Y=; b=FTJgF+MclNV7IO4Kh+4Br2y3ztlwFGfYtAMkNfWsJzmWvelGQGuejAH1g9WcZrs3rF eRQQV4DLdeyAEpoYNqbQpz14j/UQ9tOdsHDWMQFXi/+X3qryLf4EpIxWozmr66Z6osqG kcaizPEg+lg7XPLSh2M1KR6D/eS67QHsL+qmzwvQ6hL1jvaPAdyzDgnrH6vvpKqBqR3Y jj+G8VdcqqT/19FYNHqckUfSRGfbaJULckawZn2cHkq7m1zBw9ZkUizxRfzsp4adwfoB yCYzGacPa1dwkH+N+BDM6JZTdkNlcNrlhG+jWntFa5PshQQ9zl725HSEjnjZQbFs4u8q yhCw==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type; bh=DZrciXksHlCrg2L8yxlyF9McM97q+xNN21wuF0gO60Y=; b=Dm5GZ60kgkQipD7DiOUynxMfGxXeaiVh5EX3fhqah0iiJzFM53IPPl1/W7bwCd5wjN lsewQi2rDAAC3sI/ra3qzvmJxwXsWho2OE97o8+rVaoKf3DodWMgZ9Twt3AcOUfw3Y2y VkL/3a8o2XkOudERMnYj1AoeeGAs0oBYq7SfQJbWpr5iPFVJCOtU4J6Y034kTzSHr9RV 4HheJHYbOb87EwXxq8UiY/VBqPeQEbewnZpFhD3OW7dRhnzHzAJNbu2xl0FD5NmU/OXS hTbud8ElRuWQnJmrzB95CS1Mwhk2sWCvQSOy68L30qOKjGVTBk6UsNb9v6CEbIxCddit DKpA==
X-Gm-Message-State: ALoCoQlvG1YeTvVVmCNzhjZcfGGf2XDM8UmUREQJKLv/xacRllvGAKFyY+IBZ5is3bCmI9voYaqq
MIME-Version: 1.0
X-Received: by 10.182.130.234 with SMTP id oh10mr16311558obb.58.1446494371820; Mon, 02 Nov 2015 11:59:31 -0800 (PST)
Received: by 10.76.44.145 with HTTP; Mon, 2 Nov 2015 11:59:31 -0800 (PST)
In-Reply-To: <CACsn0c=ZVW2ii8pr_CL0MpNc=+ctCj86AeBubRCJb95tp89a1g@mail.gmail.com>
References: <CACsn0c=ZVW2ii8pr_CL0MpNc=+ctCj86AeBubRCJb95tp89a1g@mail.gmail.com>
Date: Mon, 02 Nov 2015 09:59:31 -1000
Message-ID: <CAFewVt4U-FkT8B0NVBs-c5=Mma6TwnKBVTE20yToptFvBp1tjg@mail.gmail.com>
From: Brian Smith <brian@briansmith.org>
To: Watson Ladd <watsonbladd@gmail.com>
Content-Type: multipart/alternative; boundary="089e013a011233d1a105239437fa"
Archived-At: <http://mailarchive.ietf.org/arch/msg/tls/-4hRshzg_C4W69DtyZZru3guy-Q>
Cc: "tls@ietf.org" <tls@ietf.org>
Subject: Re: [TLS] AES-GCM and ChaCha-Poly1305: how many bytes are safe?
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 02 Nov 2015 19:59:34 -0000
Watson Ladd <watsonbladd@gmail.com> wrote: > For these results a > sender of 2^60 messages can tolerate 2^60 forgery attempts while the > probability of forgery is at most 1.002/2^52. TLS only allows one forgery attempt per connection (thus per key). That is, as soon as a TLS implementation fails to verify a record's authentication tag, it must shut down the connection. Thus, it would be more useful to state the analysis as "Observing X signed records over Y bytes increases the odds of the attacker forging the next record to Z." Cheers, Brian -- https://briansmith.org/