Re: [TLS] Encryption of TLS 1.3 content type

[[e-mail] (Martin Rex)]

I also object to the removal of the ContentInfo from the outer
TLS record protocol.  I'm not aware of the slightest rationale for
this severe backwards incompatibility, that will not just break
middle-boxes, but also applications that parse TLS records for the
purpose of non-blocking operation.


Colm MacCárthaigh wrote:
>
> Leaking alert messages has been a recurring theme common to several
> attacks; hindering a MITM's ability to discern alert messages seems
> like a rational rationale.

Which attacks do you have in mind?  I'm actually not aware of any.

The Bleichenbacher PKCS#1 decryption oracle happened during the
cleartext phase (so this doesn't apply here), and while the
CBC guessing happened in the encrypted phase, the attacker was
in posession of the decryption key, could properly decrypt the
alert, and use it to distinguish decryption failure from mac failure
alerts.

So in both situations, content hiding would not have had the slightest
impact on these attacks.

-Martin