Re: [TLS] TLS1.3

[Peter Gutmann <[e-mail]>]

[CC'd to Hugo Krawczyk, we really need another cryptographer in on this 
 alongside Kenny Paterson since the rest of us are mostly just guessing/
 speculating.  So the debate is about switching TLS to use encrypt-then-
 MAC from its current vulnerability-prone MAC-then-encrypt]

Martin Rex <[e-mail]> writes:

>But this sounds like your changing the semantics for all ciphersuites,
>including the GenericStreamCipher PDU, which includes ciphers such as 
>TLS_RSA_WITH_RC4_128_MD5, and AEAD ciphersuites.

OK, there are two more lines of code I didn't show (since they're in the 
calling function), the code there is something like:

switch( protection_type )
  case classic_SSL: wrapPacketSSL();
  case AEAD: wrapPacketAEAD();
  case encrypt_then_MAC: wrapPacketEthenM();

So it's really two lines added and two lines swapped (+syntactic sugar
and comments).  And several hundred lines of ad-hockery to deal with
MAC-then-encrypt vulnerabilities sidelined.

>I would really hate having to add a black-list of cipher suites that must 
>not be used with the new scheme (such as TLS_RSA_WITH_RC4_128_MD5) in a 
>few years, when it turns out that an HMAC-MD5 is too weak.

In what way would HMAC-MD5 be "too weak"?  I agree that HMAC-SHA1/
SHA256 are a better proposition, but using HMAC-MD5 should be up to
the implementer in any case. I've deprecated it for some years now, the
minimum I'll do is HMAC-SHA1.  It's not as if there's a shortage of suites
to choose from, and I've never found anything that does only -MD5 and
not -SHA1.

Peter.