Re: [TLS] Finished stuffing/PSK Binders

Eric Rescorla <ekr@rtfm.com> Fri, 07 October 2016 17:08 UTC

Return-Path: <ekr@rtfm.com>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 44D7312967D for <tls@ietfa.amsl.com>; Fri, 7 Oct 2016 10:08:45 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.599
X-Spam-Level:
X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id n7CQT8eNlEQQ for <tls@ietfa.amsl.com>; Fri, 7 Oct 2016 10:08:43 -0700 (PDT)
Received: from mail-yw0-x22e.google.com (mail-yw0-x22e.google.com [IPv6:2607:f8b0:4002:c05::22e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7FF2E129663 for <tls@ietf.org>; Fri, 7 Oct 2016 10:08:43 -0700 (PDT)
Received: by mail-yw0-x22e.google.com with SMTP id u124so35870381ywg.3 for <tls@ietf.org>; Fri, 07 Oct 2016 10:08:43 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=5nQaLjenmIEupa5vi7pI4aviS5CY2mtITuPokz+RSvM=; b=CnVVI8j1Yj3LJv5pJotA8WI48L/xRJsB1dSZzWfeHeS9ZilsAdG4AF4uuAJAvmdOfz qbJeHdoYm95vws2O37ZVTvbC945Ef2O5LofAqhisYsln2DfXsgzYwQVUIJDKno885iU7 /vRJuTKckXK/FIMNBAdQs+Slfc9/aWNOim2NDh42ZfxQFVL2bGuJvwCreQL4UejA+QrW TenbquzYaPdNkwFUQ6oy3CiRjfltdv2U02z69Oyn0v3QfAeEvfkzPwQYTDDKnp/yHyEA GxrOjfVi9ZhCJpZradqVkuDp/WQ1Z5st+5mPD05myVlObi1e/Cz2f1q4wNysvIaUYAoq stHw==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=5nQaLjenmIEupa5vi7pI4aviS5CY2mtITuPokz+RSvM=; b=ht7NAYNQ230XvLH1fr9gK+3cz05wPDrprfbg/tXWDDlBUUK411l4llTIpBhBTQsqhH MvuaWX3+B0cAF89TyURTW65jOfmNQJuvCCjA/PBpvjDb8Ke9TFOcFlwfJLyGZYx+33Hc hdbSTso7yBEOF/kQdHi/HIWExyjxA3GZ22csx53FHOYseA4hEbQvifh98Ar8pK3gEJzN DuT6mXkHFebVZQ0LdlraCMYo9CUotc+4MBeAmiTs072ouZgLAVccL6EgVXZDQfccQUNt TiPPJocREkcZTYoTMxdc/eNrW1++w1tBe4OiZVhT4FbMoSFn4i5CKmYJuT0fOPl5hw/G S7RA==
X-Gm-Message-State: AA6/9RnJaqfa3+Vt66eA0Uy/3PiocawzYfnsL+amZZUCHuxS91XEfZ8sVqvuBVvmq2ruxgkhsQbTS6S7nkD/hg==
X-Received: by 10.129.53.206 with SMTP id c197mr15896511ywa.205.1475860122732; Fri, 07 Oct 2016 10:08:42 -0700 (PDT)
MIME-Version: 1.0
Received: by 10.129.75.212 with HTTP; Fri, 7 Oct 2016 10:08:02 -0700 (PDT)
In-Reply-To: <20161007170323.GA9856@LK-Perkele-V2.elisa-laajakaista.fi>
References: <CABcZeBOJPz8DY92LE6531xbRYLU-Wvkqeb-vTX59gU5rYcp+Ww@mail.gmail.com> <20161007152628.GA9408@LK-Perkele-V2.elisa-laajakaista.fi> <CABcZeBO5HEJAm=QO2NjEWHAH_mKBUBoPn0=Zw5mtKmVz9SP=wQ@mail.gmail.com> <20161007170323.GA9856@LK-Perkele-V2.elisa-laajakaista.fi>
From: Eric Rescorla <ekr@rtfm.com>
Date: Fri, 07 Oct 2016 10:08:02 -0700
Message-ID: <CABcZeBNp6wjxHBQ+io2Pcwd364=iiobKp-UHZZxOYZbmR7X7AQ@mail.gmail.com>
To: Ilari Liusvaara <ilariliusvaara@welho.com>
Content-Type: multipart/alternative; boundary="001a11421a265acb57053e49761b"
Archived-At: <https://mailarchive.ietf.org/arch/msg/tls/6brR4XM9kJ5nwV9KtTuLRpz1Qzw>
Cc: "tls@ietf.org" <tls@ietf.org>
Subject: Re: [TLS] Finished stuffing/PSK Binders
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.17
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 07 Oct 2016 17:08:45 -0000

On Fri, Oct 7, 2016 at 10:03 AM, Ilari Liusvaara <ilariliusvaara@welho.com>
wrote:

> On Fri, Oct 07, 2016 at 09:35:40AM -0700, Eric Rescorla wrote:
> > On Fri, Oct 7, 2016 at 8:26 AM, Ilari Liusvaara <
> ilariliusvaara@welho.com>
> > wrote:
> >
> > > On Fri, Oct 07, 2016 at 08:01:43AM -0700, Eric Rescorla wrote:
> > > > 4. I've taken a suggestion from David Benjamin to move the
> negotiation
> > > > of the PSK key exchange parameters out of the PSK itself and into a
> > > > separate message. This cleans things up and also lets us drop the
> > > > currently non-useful auth_mode parameter.
> > >
> > > Eeh... From the text, it seems to currently require the kex modes
> > > extension if PSK extension is present. Which seems worse than useless
> > > if the meaning is to get rid of the kex mode parameter from PSK
> > > extension (since you will have the value anyway, but need to dig it
> > > from another extension... Blech).
> >
> > I guess this is a matter of taste, but what convinced me was that:
> >
> > 1. It put all the logic on the server side.
> > 2. It removed the auth mod parameter.
> >
> > Maybe david can say more.
>
> I mean if server is to accept PSK, it must now go fishing for another
> extension, check that it is present and pay attention to values there.
> As opposed to having the data in where it is needed.
>

This is a reasonable argument (and the reason I stuffed the binder here).
However, David's argument was that this applied to *all* PSKs even new ones.


-Ekr

> > Also, didn't notice what prevents pathology like this (I presume this
> > > is not allowed):
> > >
> > > (Assume PSK with 0RTT allowed, using AES-128-GCM-SHA256)
> > >
> > > ClientHello[Ciphers=CHACHA20-POLY1305-SHA256, EarlyDataIndication]
> --->
> > > [0-RTT data, encrypted using AES-128-GCM-SHA256]
> > > <-- ServerHello[Cipher=CHACHA20-POLY1305-SHA256]
> > > <-- EncryptedExtensions[EarlyDataIndication]
> > >
> > > Note the record protection algorithm mismatch.
> > >
> >
> > Yes, this is forbidden by the combination of:
> >
> > "The parameters for the 0-RTT data (symmetric cipher suite,
> > ALPN, etc.) are the same as those which were negotiated in the connection
> > which established the PSK.  The PSK used to encrypt the early data
> > MUST be the first PSK listed in the client's "pre_shared_key" extension."
> > (though I think I just recently added cipher suite).
> >
> > and:
> > "Any ticket MUST only be resumed with a cipher suite that is identical
> > to that negotiated connection where the ticket was established."
>
> If 0-RTT is used with manually provisioned PSKs (might not be allowed
> currently, but might be allowed soon), does that still hold?
>
> Also, I think it is problematic that externally provisioned PSKs can
> be used with any protection with given prf-hash, while NST-provisioned
> PSKs can only be used with one protection and prf-hash.
>
> 0-RTT requirements are separate matter, since those would apply to all.
>
> The original purpose of resumption-as-PSK was AFAIK to unify the two
> mechanisms to simplify things. Therefore those two should be as similar
> as possible.
>
> >
> > Also, to straightforwardly prove that collision resistance of HKDF and
> > > HMAC (as used) follows from collision resistance of the underlying hash
> > > function, yon need to take the output to be at least the hash output
> > > size. As otherwise it is not guaranteed that any collision in HKDF or
> > > HMAC can be reduced into collision of the underlying hash.
> > >
> >
> > Right. I have some text here but please feel free to suggest more.
>
> Yes, but the text says 256 bit output is enough. One isn't guaranteed
> to be able to reduce such collision to collision of >256 bit hash.
>
> (In fact, if the hash is e.g. 384 bit, 256-bit collisions are extremely
> unlikely to reduce).
>

Right. I can update.

-Ekr


>
>
>
> -Ilari
>