Re: [TLS] TLS1.3

There's not really any need to do a TLS 1.3 for this. TLS 1.2 includes
support for AEAD ciphers, so all that would be needed is to define
an Enrypt-Then-Mac AEAD cipher and it will drop into TLS 1.2.

Best,
-Ekr

On Thu, Feb 7, 2013 at 1:47 AM, Nikos Mavrogiannopoulos <nmav@gnutls.org>wrote:

> On Thu, Feb 7, 2013 at 9:43 AM, Lewis, Nick <nick.lewis@usa.g4s.com>
> wrote:
> > With confidence in the TLS being undermined once again as a result of
> > problems with its MAC-Pad-Encrypt mechanism are there any plans to adopt
> an
> > alternative mechanism such as Pad-MAC-Encrypt in TLS1.3?
>
> Indeed that would be useful. The current padding mechanism required
> 1-2 pages of code to solve the known issues and that may not even be
> sufficient, and have yet another attack next year.
>
> For that, in gnutls we have already implemented an extension to
> include the pad into the MAC'd data and avoid any padding oracle
> attacks. The extension defines a new padding mechanism for all
> ciphersuites (with the purpose of length hiding - Alfredo may add more
> information on that), that has the side effect of fixing the known TLS
> padding issues.
>
> The extension is described at:
> http://tools.ietf.org/html/draft-pironti-tls-length-hiding-00
>
> regards,
> Nikos
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls
>