IETF Logo Mail Archive

Re: [TLS] PR for anti-downgrade mechanism

Martin Thomson <martin.thomson@gmail.com> Mon, 19 October 2015 17:05 UTC

Return-Path: <martin.thomson@gmail.com>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 01A1A1A8AE2 for <tls@ietfa.amsl.com>; Mon, 19 Oct 2015 10:05:05 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2
X-Spam-Level:
X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Y3qmvsZfF_e5 for <tls@ietfa.amsl.com>; Mon, 19 Oct 2015 10:05:03 -0700 (PDT)
Received: from mail-yk0-x22d.google.com (mail-yk0-x22d.google.com [IPv6:2607:f8b0:4002:c07::22d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 894681A8AC6 for <tls@ietf.org>; Mon, 19 Oct 2015 10:05:03 -0700 (PDT)
Received: by ykfy204 with SMTP id y204so149017621ykf.1 for <tls@ietf.org>; Mon, 19 Oct 2015 10:05:03 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=Q0NflVhhoedXbedqhVA+idHF6ms6M10JchwDhdnVdHw=; b=01R52tOkP7WTycB0ktGLsYOncNJs7cBkHYhsX6JU+VzobHEkrM1kxBmIQ5k7kKlQbT nqb22svB28KW9f0y5S/poB550G8umr5Kn1OBdnk9d6asYHVFfQZwIbMMA1fWvzy/x7YJ fe0jykXEhoDkGKmYN+aNK2zT60I489b8mHkHVoCQ0ZeGiqZJcvYaEEgi6BanRMAXQKbk y4NF8MMeInj5jk1yov59vcNF03gCtcA3SilWV/YtspjrhIXPp0kxEDIgm5hHQ8iXYM0G 40DTFkTNXgono8Ilr6jomTHKww5J+cQ+hVz8PflGlJrkMgeerRXRw3xYjHhIWtrbIdPE KFfQ==
MIME-Version: 1.0
X-Received: by 10.129.79.129 with SMTP id d123mr20676015ywb.159.1445274302840; Mon, 19 Oct 2015 10:05:02 -0700 (PDT)
Received: by 10.129.132.145 with HTTP; Mon, 19 Oct 2015 10:05:02 -0700 (PDT)
In-Reply-To: <CABcZeBMn9=H3A2EpQonB1rM5ApZ68hzdNHRQf6NOU+7C6_iiiA@mail.gmail.com>
References: <CABcZeBOB9mnQ8bLOCSysnx9LMv0hxrPCA21jTnxAMb3Yom_Aow@mail.gmail.com> <201510171708.16547.davemgarrett@gmail.com> <CABcZeBOzJkdjC-NnjPcHtoU_6rmEMPqj4Y7xKuA=CHZLT9r49w@mail.gmail.com> <201510171734.26589.davemgarrett@gmail.com> <CABcZeBNFvUN6KOpzGO5_tPU9dqbJ8q=k_CaqmkjeCR_hS2RCOg@mail.gmail.com> <20151017220548.GF15070@mournblade.imrryr.org> <CABcZeBPhmq+0k8gVs9FcZ6T-_SehqrWkL0BzkB5z8=DgXy1Saw@mail.gmail.com> <20151017221733.GG15070@mournblade.imrryr.org> <CABcZeBOew4DTOzj1Q=G9_o87SjH-hF85VWmz1U38P1WedjkuYg@mail.gmail.com> <20151017230257.GI15070@mournblade.imrryr.org> <84C5B67D-F236-4BFD-AA13-5CC13062B8C5@akamai.com> <CABcZeBMn9=H3A2EpQonB1rM5ApZ68hzdNHRQf6NOU+7C6_iiiA@mail.gmail.com>
Date: Mon, 19 Oct 2015 10:05:02 -0700
Message-ID: <CABkgnnVRO56392s068xeB_Lnn6qoVu_MBbwWRcKe=p8YPQ2RUw@mail.gmail.com>
From: Martin Thomson <martin.thomson@gmail.com>
To: Eric Rescorla <ekr@rtfm.com>
Content-Type: text/plain; charset="UTF-8"
Archived-At: <http://mailarchive.ietf.org/arch/msg/tls/3wVYvEf65rS8RtslvvEQpjEso4I>
Cc: "tls@ietf.org" <tls@ietf.org>
Subject: Re: [TLS] PR for anti-downgrade mechanism
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 19 Oct 2015 17:05:05 -0000

On 19 October 2015 at 08:08, Eric Rescorla <ekr@rtfm.com> wrote:
> overloading the time field
> lowers the risk of false positives because we can choose a sentinel that
> will never
> collide with a conformant TLS 1.2 ServerHello. By contrast, a sentinel in
> the
> randomly generated portion always has a 2^{-n} chance of collision.

Yes, this is right.  The marginal gain is that the proportion of
servers that generate a time here are immune to collisions.  If
servers all servers did that, we wouldn't have to worry about
collisions at all. Unfortunately, we do know that some generate random
values.

v2.23.0 | Report a Bug | By Email