Re: [TLS] Rethink TLS 1.3

[[e-mail] (Martin Rex)]

Nico Williams wrote:
>
> Martin Rex wrote:
>>
>> Nope.  BEAST, CRIME and Poodle are pretty boring demonstrations of the
>> ridiculous insecurity of WebBrowsers in their default configuration.
> 
> Yes, they were that too.  And by then we knew well about adaptive
> plaintext attacks.  Still, they also were demonstrations that the
> network has to be assumed to be under control of the adversary, and IMO
> they were dramatic at that.  If anyone still doubted the adversary's
> control of the network before BEAST, no one does now.


5 years ago there was an exhausting discussion in this WG about how to
fix the TLS renegotiation issue.  The problem had been considered so huge,
that a secret group (Project Mogul) had been setup to design (and have
patches shipped) before the issue was publicly described.

BEAST and Poodle require *MORE* control over the endpoint as a prerequisite
for the attack than what a successful TLS renegotiation attack will provide.

Please stop claiming that providing so much control to an attacker
as something that is (or should be) normal, rather than considering
providing so much control to attackers as what it really is:
a huge and gaping vulnerability in Web-Browsers and in the
(lack of a) Web Security Model.


-Martin