Re: [TLS] Rizzo claims implementation attach, should be interesting

[Martin Rex <[e-mail]>]

Eric Rescorla wrote:
> 
> On Mon, Sep 19, 2011 at 7:31 PM, Marsh Ray <[e-mail]> wrote:
> > Does anyone believe there would be support for a TLS 1.0 Hello extension
> > that could compatibly negotiate the use of empty messages in each direction
> > as a mitigation for this attack?
> 
> The difference between TLS 1.0 and TLS 1.1 is so slight that if TLS
> 1.1 is indeed immune it would probably be easier to just have servers
> upgrade to 1.1.


Using the TLSv1.1 explicit random IVs for TLS cipher suites with
block ciphers in CBC-mode would be my preferred solution -- provided
that a significant majority believes this to be a sufficient mitigation.
(Personally, I think that it is not a clean solution, but may be OK
 as a mitigation that makes this attack sufficiently "expensive").


I don't see why adding and enabling TLSv1.1 on Servers should cause
interop problems, but I'm completely lacking experience in that area
to make any assessments. 

A client that announces TLSv1.1 (and no application level reconnect
fallback) is much more likely to run into interop problems, similar
to a client that includes a TLS extension in ClientHello.  Newer
Browsers (those that are affected by this Man-in-the-Browser attack)
usually have a reconnect fallback capability and should be able
to cope with this.


But really, the underlying problem is letting an attacker reuse
the very same symmetric key for his own data (adaptive chosen plaintext).
Knowing the IV ahead of time can significantly improve an adequate choice
of plaintexts, which is why the problem is worse in SSLv3 and TLSv1.0.

But it should really be possible for browsers to seperate the TLS sockets
that evil code can use and the sockets that victim code can use safely.
Sharing cached TLS sessions is not a problem, each connection will
derive their own traffic encryption and mac keys.  If Browsers can not
seperate those network traffics, then there will be much more serious
problems in the browser architecture to worry about than an attack
that requires a cooperating network sniffer and malware running in
your browser and a significant amount of network traffic between
them.


-Martin