Re: [TLS] draft-ietf-tls-cached-info-02 / New "Fast-Track" draft posted

[Adam Langley <[e-mail]>]

On Tue, Feb 2, 2010 at 10:32 AM, Nikos Mavrogiannopoulos
<[e-mail]> wrote:
> What if I modify the server's messages, so you negotiate to a
> ciphersuite I can break, or I can derive information from (say the
> length of the plaintext data you send- as with rc4). You will not detect
> my attack until you receive the server's finished message, wouldn't you?
>
> I think this mode is walking on the edge.

Obviously, if the server can cause the client to use a NULL cipher (or
something very weak) then cut through should not be used. For Android,
cut through mode will not be used if the cipher key length is less
than 128 bits.

The length of the application data records are observable on the wire
in any case. The only advantage that an attacker could gain here is to
choose a cipher that doesn't pad records to get a slighter more
accurate length.

Given how extremely valuable saving a round trip is, we choose to make
this tradeoff.


AGL