Re: [TLS] Rethink TLS 1.3

[Brian Smith <[e-mail]>]

Martin Rex <[e-mail]> wrote:
> 5 years ago there was an exhausting discussion in this WG about how to
> fix the TLS renegotiation issue.  The problem had been considered so huge,
> that a secret group (Project Mogul) had been setup to design (and have
> patches shipped) before the issue was publicly described.

In terms of deployment of the solution, that approach wasn't
successful, as the secure renegotiation extension is far from
ubiquitous. The secret group designed a solution to solve the
renegotiation flaw but not the quite similar Triple Handshake flaw. It
would be interesting to know if somebody had proposed a (rejected)
solution for the renegotiation flaw that would have also fixed the
Triple Handshake flaw. In particular, we should recognize that the
"conservative" approach of making minimal changes to address
individual issues has negative consequences. Further, the
renegotiation flaw, BEAST, CRIME, Triple Handshake, etc. all should be
seen as evidence that the development model for TLS should shift to
one that is likely to preempt unknown attacks, instead of one that
reacts to attacks.

> Please stop claiming that providing so much control to an attacker
> as something that is (or should be) normal, rather than considering
> providing so much control to attackers as what it really is:
> a huge and gaping vulnerability in Web-Browsers and in the
> (lack of a) Web Security Model.

Attackers having that level of control is normal for people who build
software for the web, which is a very large group of people in the TLS
community. Ultimately, this means that adaptive chosen plaintext
attacks and other negative consequences of the web security model are
well within scope.

Cheers,
Brian