IETF Logo Mail Archive

Re: [TLS] Results of interim meeting

Watson Ladd <watsonbladd@gmail.com> Mon, 26 May 2014 20:38 UTC

Return-Path: <watsonbladd@gmail.com>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E2CF41A0278 for <tls@ietfa.amsl.com>; Mon, 26 May 2014 13:38:12 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2
X-Spam-Level:
X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id v8zXsi5OF_Df for <tls@ietfa.amsl.com>; Mon, 26 May 2014 13:38:11 -0700 (PDT)
Received: from mail-yh0-x236.google.com (mail-yh0-x236.google.com [IPv6:2607:f8b0:4002:c01::236]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1CB441A0275 for <tls@ietf.org>; Mon, 26 May 2014 13:38:11 -0700 (PDT)
Received: by mail-yh0-f54.google.com with SMTP id i57so6716727yha.41 for <tls@ietf.org>; Mon, 26 May 2014 13:38:07 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=F3TX3EzylQR9NIQwiGUZBz/8qBkcN/zi2yYMSnjvi2U=; b=Xf5WEu+jlsfUhyIauH7ZBwF9EYnBFH3R6U5mOpofnICPaIVyOIG1cKoVfbB4B+26PT Erx/+l/MPsPUhJ3JNVHzjjk1Nk7kSLpBQf76ZzanKZVZgHSV6lkXB7mgisunFIr4fvHW t7hEs5jFKDwKYo0eFLgieDCVvzvXdIhrNWw1iApqaaRvpEPmNCtOuddntPKv+hWQooAg iQdCLQOubF2hpfzi9ZXwnhEKRdvE0hjAMqviDDNnTqSo/pNp8unkUd7ebbSbNyp/bnbG dKtAgBXOnaAZpRf9hoTS0EV5GgHLI5AGFJhzXt2bMmg2RTGqAEAEty4KpzH3rC/hOFPx 1q1A==
MIME-Version: 1.0
X-Received: by 10.236.120.66 with SMTP id o42mr39400100yhh.66.1401136687843; Mon, 26 May 2014 13:38:07 -0700 (PDT)
Received: by 10.170.39.136 with HTTP; Mon, 26 May 2014 13:38:07 -0700 (PDT)
In-Reply-To: <53839895.5000508@mit.edu>
References: <CACsn0cmHwo6E2tGZu64q0RxTdzvxGgh8Jonzj4rr1zZxehswLg@mail.gmail.com> <53839895.5000508@mit.edu>
Date: Mon, 26 May 2014 13:38:07 -0700
Message-ID: <CACsn0cnp2cCSVY5S9DB3BZxUCFckjmnq0eMfb+XyvFPdWyoFxg@mail.gmail.com>
From: Watson Ladd <watsonbladd@gmail.com>
To: Andy Lutomirski <luto@amacapital.net>
Content-Type: text/plain; charset="UTF-8"
Archived-At: http://mailarchive.ietf.org/arch/msg/tls/1Bk4imFBoKk99bp53C4kH_x0-h0
Cc: "tls@ietf.org" <tls@ietf.org>
Subject: Re: [TLS] Results of interim meeting
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 26 May 2014 20:38:13 -0000

On Mon, May 26, 2014 at 12:40 PM, Andy Lutomirski <luto@amacapital.net> wrote:
> On 05/26/2014 09:34 AM, Watson Ladd wrote:
>> Dear all,
>>
>> It looks like most of the slides were devoted to SNI, and it is not
>> clear what was actually decided.
>>
>> I haven't seen any slides about Triple Handshake, despite being on the
>> interim agenda. Is this a sign that the proposed fix for TLS 1.2 is
>> acceptable?
>
> There was a concern that the proposed fix might allow the client to
> construct two different ClientHellos that would nonetheless result in
> the same tls-unique value using the pre-TLS-1.2 PRFs.  The issue is
> that, if you could find a SHA-1 collision, then MD5 is short enough that
> it could be possible to do a length-extension attack and brute-force it
> to be an MD5 collision as well.

Yes, this is a problem. Basically the session hash needs to be
computed with a secure hash, and TLS 1.1 and before don't use secure
hashes.
I don't think the proposed fix makes this issue worse: from my reading
of TLS 1.1 and the tls-unique (should be renamed sometime) the
Finished message is computed with the concatenation of a SHA1 and MD5
hash of the messages.

How we fix it I don't know yet.
>
> No one present knew whether this mattered.

It seems to me that this would be a problem, and is also a problem for
the TLS 1.1 finished message for the same reason. The core issue is
this: http://www.iacr.org/cryptodb/archive/2004/CRYPTO/1472/1472.pdf.

In short, with 64 invocations of the hypothetical SHA-1 break, then
2^64 MD5 calculations, you find a collision for the TLS 1.1 finished
message. So the composite construction in TLS 1.0 and TLS 1.1 is no
more secure than SHA-1. And yes, the dates of TLS 1.1 authorship and
the authorship of the paper explaining this flaw are 2006 and 2004
respectively.

Sincerely,
Watson Ladd
>
> --Andy



-- 
"Those who would give up Essential Liberty to purchase a little
Temporary Safety deserve neither  Liberty nor Safety."
-- Benjamin Franklin

v2.23.0 | Report a Bug | By Email