Re: [TLS] TLS 1.2 Long-term Support Profile draft posted

On Wed, Mar 16, 2016 at 5:36 AM, Peter Gutmann
<pgut001@cs.auckland.ac.nz> wrote:
> After a number of, uh, gentle reminders from people who have been waiting for
> this, I've finally got around to posting the TLS-LTS draft I mentioned a while
> back.  It's now available as:
>
> http://www.ietf.org/id/draft-gutmann-tls-lts-00.txt
>
> Abstract:
>
>    This document specifies a profile of TLS 1.2 for long-term support,
>    one that represents what's already deployed for TLS 1.2 but with the
>    security holes and bugs fixed.  This represents a stable, known-good
>    profile that can be deployed now to systems that can't can't roll out
>    patches every month or two when the next attack on TLS is published.
>
> Several people have already commented on it off-list while it was being
> written, it's now open for general comments...

Several comments:

As written supporting this draft requires adopting the
encrypt-then-MAC extension. But there already is a widely implemented
secure way to use MACs in TLS: AES-GCM. Likewise, this draft modifies
the way the master secret is computed, despite a widely implemented
different solution to the problem, namely the EMS triple handshake
fix. I don't see why these other solutions should be adopted over the
ones that already are there.

The use of uncompressed points makes off-curve attacks much easier
than with compressed points. Recommendations to not reuse randoms for
ECDH and to use Curve25519 would actually solve the problems, instead
of what the draft has right now.

The analysis of TLS 1.3 is just wrong. TLS 1.3 has been far more
extensively analyzed then TLS 1.2. It's almost like you don't believe
cryptography exists: that is a body of knowledge that can demonstrate
that protocols are secure, and which has been applied to the draft.

The ladder diagram/state machine discussion ignores the real problem,
which is not having either represented in the code. It doesn't direct
readers to do anything that helps solve the problem, such as testing
for the correct state transitions.

>
> Peter.
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls

-- 
"Man is born free, but everywhere he is in chains".
--Rousseau.