Re: [TLS] Encryption of TLS 1.3 content type

[Viktor Dukhovni <[e-mail]>]

On Mon, Jul 28, 2014 at 05:14:16PM +0200, Nikos Mavrogiannopoulos wrote:

> On the contrary, all _new_ ciphers are stream (GCM, CCM) and every
> future AEAD cipher will be a stream one (due to limitations of the AEAD
> construction in TLS). Furthermore, even if you assume that only AES-CBC
> is going to be used, do you really consider a 16-byte alert packet
> fuzzed? Do you know many application protocols that transfer such short
> packets?

[ Note, I far from convinced that encrypting the record type is useful ]

Yes, some application application protocols do send short messages,
for example SMTP an server may reply "250 2.0.0 OK\r\n".  However,
(fatal) alerts often terminate the connection and are easily
distinguished from routine traffic.

In chatty protocols, like SMTP, TLS masks the specific content,
but not the overall flow or size of messages.  One can often tell
which application data messages carry "EHLO", "MAIL", "RCPT", "DATA"
and the message payload, despite the use of TLS.  The attacker does
not learn very much, but may be able to estimate the recipient
count, even with ESMTP PIPELINING and of course can estimate the
message size fairly well.

Defending against traffic analysis is very difficult, and I don't
think that TLS can (or should attempt to) do the job.

-- 
	Viktor.