Re: [TLS] Rethink TLS 1.3

[Nikos Mavrogiannopoulos <[e-mail]>]

On Thu, 2014-11-27 at 15:01 -0800, Watson Ladd wrote:
> On Thu, Nov 27, 2014 at 1:04 AM, Nikos Mavrogiannopoulos
> <[e-mail]> wrote:
> > On Wed, 2014-11-26 at 16:03 -0800, Watson Ladd wrote:
> >
> >> >> Parsing TLS is one of the biggest issues in implementations. I can't
> >> >> promise to write the tool to auto-generate the parser, but we should be
> >> >> sufficiently chastised by all those who tried and failed to parse TLS
> >> >> records with handwritten C to consider not doing it ourselves.
> >> > Where does this come from? TLS is one of the easiest protocols to parse.
> >> OpenSSL couldn't parse an echo request correctly.
> >
> > This is a TLS extension and is known to be unnecessarily complex. It
> > proves nothing about the TLS parsing complexity that you mention.
> 
> The construct of a heartbeat payload is a vector. It's simpler, not
> more complex, than many structures in TLS.

Then you may not have seen many structures in TLS. The heartbeat
structure is unlike _any_ other structure in TLS. 
   struct {
      HeartbeatMessageType type;
      uint16 payload_length;
      opaque payload[HeartbeatMessage.payload_length];
      opaque padding[padding_length];
   } HeartbeatMessage;

So you have a length, and two payloads. One is padding with separate non
explicit length, defined as "padding_length = TLSPlaintext.length -
payload_length - 3", and the other is supposed to have the previously
mentioned length. That construction is unique on the TLS protocol, and
has interesting properties, such as the padding length affecting the
TLSPlaintext.length it depends on it. It is no surprise it has caused
bugs.

A simple structure according to the TLS rules is:
   struct {
      HeartbeatMessageType type;
      opaque payload<0..2^16-1>;
   } HeartbeatMessage;

With the latter you can reuse any parser already created for TLS
messages, and you have no interplay between different lengths. The
former requires a special parser. So really have you actual read, or
tried to implement the documents that you claim are simple or complex?

regards,
Nikos