[TLS] Question about client impersonation... was Re: ETSI releases standards for enterprise security and data centre management]
Dan Brown <danibrown@blackberry.com> Sun, 02 December 2018 21:47 UTC
Return-Path: <danibrown@blackberry.com>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 499D5124D68 for <tls@ietfa.amsl.com>; Sun, 2 Dec 2018 13:47:52 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.599
X-Spam-Level:
X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id djyply0DEA-X for <tls@ietfa.amsl.com>; Sun, 2 Dec 2018 13:47:49 -0800 (PST)
Received: from smtp-p01.blackberry.com (smtp-p01.blackberry.com [208.65.78.88]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 03D01130DBE for <tls@ietf.org>; Sun, 2 Dec 2018 13:47:48 -0800 (PST)
Received: from smtp-pop.rim.net (HELO XCT103CNC.rim.net) ([10.65.161.203]) by mhs210cnc.rim.net with ESMTP/TLS/DHE-RSA-AES256-SHA; 02 Dec 2018 16:47:47 -0500
Received: from XMB116CNC.rim.net ([fe80::45d:f4fe:6277:5d1b]) by XCT103CNC.rim.net ([fe80::b8:d5e:26a5:f4d6%17]) with mapi id 14.03.0415.000; Sun, 2 Dec 2018 16:47:46 -0500
From: Dan Brown <danibrown@blackberry.com>
To: Tony Arcieri <bascule@gmail.com>, "beldmit@gmail.com" <beldmit@gmail.com>
CC: Crypto <cryptography@metzdowd.com>, "<tls@ietf.org>" <tls@ietf.org>
Thread-Topic: Question about client impersonation... was Re: [TLS] ETSI releases standards for enterprise security and data centre management]
Thread-Index: AdSKiKljmGMdPbPrRIOVrYLRrn/xhw==
Date: Sun, 02 Dec 2018 21:47:46 +0000
Message-ID: <20181202214741.8675410.92893.30114@blackberry.com>
Accept-Language: en-US, en-CA
Content-Language: en-US
X-MS-Has-Attach: yes
X-MS-TNEF-Correlator:
Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg="SHA1"; boundary="===============1774177272=="
MIME-Version: 1.0
Archived-At: <https://mailarchive.ietf.org/arch/msg/tls/5a81d_Dscwxp11_DbLbUP2UV_vw>
Subject: [TLS] Question about client impersonation... was Re: ETSI releases standards for enterprise security and data centre management]
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sun, 02 Dec 2018 21:47:52 -0000
Is the security property mentioned below a defined goal of, and proved for, TLS 1.3? Just curious, because it seems a little counter-intuitive: impersonation of an anonymous (unauthenticated) client, under the harsh conditions of all content in the clear. It is certainly plausible by regarding the client as having a a MAC key and a pseudonym from the handshake: I think many key exchange proofs have a notion of sessions, etc., and PKE definitions also have notions of non-malleability, so I would not be surprised if a proof of this property is known for TLS 1.3. If there is a proof, then could it be said that eTLS defeats the proof, etc. From: Tony Arcieri Sent: Saturday, December 1, 2018 11:00 AM To: beldmit@gmail.com Cc: Crypto; <tls@ietf.org> Subject: Re: [TLS] ETSI releases standards for enterprise security and data centre management This does not seem to address a problem which was brought up when the similar draft-green-tls-static-dh-in-tls13-00 was discussed, namely any system in possession of one of the non-ephemeral-ECDHE private keys, ostensibly for the purposes of passive traffic decryption, can arbitrarily resume decrypted sessions and therefore impersonate any observed clients.. I'm not a fan of systems like this, but I believe for security reasons they should be designed in such a way that only the confidentiality of traffic is impacted, and a "visibility" system isn't able to leverage the decrypted traffic to resume decrypted sessions and thereby impersonate clients. -- Tony Arcieri