Re: [TLS] Simplifying the record protocol

[Tom Ritter <[e-mail]>]

On 11 June 2014 03:44, Nikos Mavrogiannopoulos <[e-mail]> wrote:

> On Tue, 2014-06-10 at 22:56 -0400, Tom Ritter wrote:
>
> > An advantage of encrypting the content type is making it possible for
> > TLS padding to be built-in for no additional bytes.
>
> TLS padding can be built-in for no additional bytes and for no change in
> outside format of the TLS record:
> http://tools.ietf.org/html/draft-pironti-tls-length-hiding-02
>
>
I would strongly prefer padding not to require an extension and be built
in. While some extensions could be protected in an encrypted handshake (See
Type B extensions in [0]), this would require a significant change to
extensions and I'm not banking on it.  So assuming that extensions are in
the clear, I would prefer an observer be unsure if there is padding or not.

This is especially important because a large class of attacks we want to
defend against are passive attacks, where the observer has only a single
traffic stream and wants to try correlation, and is unable to induce
multiple sends or streams with which to try statistical or timing
correlation.

(Re-reading the draft and minutes[1]) I believe that the padding in this
draft, if we remove the extension, would add an additional two bytes to all
messages to be unambiguous and indicate if there is padding or not. If I'm
wrong about that, I don't think I'm the only one so I'd be happy to be
corrected.

My goal is to get padding support (for receiving, not necessarily sending)
built in to the protocol, with no additional on-wire bytes for people who
don't want to pad, and with no plaintext indicators of whether padding is
being done or not.

-tom


[0]
http://www.ietf.org/proceedings/interim/2014/05/15/tls/slides/slides-interim-2014-tls-1-4.pdf
[1]
http://www.ietf.org/proceedings/interim/2014/05/15/tls/minutes/minutes-interim-2014-tls-1
around "Padding issues "