IETF Logo Mail Archive

Re: [TLS] Security review of TLS1.3 0-RTT

Martin Thomson <martin.thomson@gmail.com> Thu, 04 May 2017 01:15 UTC

Return-Path: <martin.thomson@gmail.com>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EE8421294C4 for <tls@ietfa.amsl.com>; Wed, 3 May 2017 18:15:20 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -0.801
X-Spam-Level:
X-Spam-Status: No, score=-0.801 tagged_above=-999 required=5 tests=[BAYES_20=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jV1GYfa_GGnQ for <tls@ietfa.amsl.com>; Wed, 3 May 2017 18:15:19 -0700 (PDT)
Received: from mail-lf0-x229.google.com (mail-lf0-x229.google.com [IPv6:2a00:1450:4010:c07::229]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 72C0C1294F8 for <tls@ietf.org>; Wed, 3 May 2017 18:15:19 -0700 (PDT)
Received: by mail-lf0-x229.google.com with SMTP id j1so2010977lfh.2 for <tls@ietf.org>; Wed, 03 May 2017 18:15:19 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=5/1ZPz4QRUO/qR4avIcKS9T94CjuqBqu/FTsuMTUF+k=; b=fXNcQQ98pCZkTeulNrootFNu+e6tQjCAyFOeWA0dRKF8TqU3UsFHkTOuYXkQFvxIz8 edtTwtCu+NwmtpNEW8SkfmwP1m1AvWe7S2u/qbwwmSQh3Wvrmr2fNPI0Bc+cg4mAymAC 8x7mv6nvoC5effghK3bwFfSsE86HMr9bGQs7Dvz9yEjCyigSbOOS9KwrmmDiLVgltj5k tI3ZVeDM3eXmNWtHCCe81Q5iFj48esMt2hfP4mUSyx+tKXR2AExmuKF5VOxFTNVOmUSz igRyXorxLt9Cpy4rg+bUq0CYIhRhtluQKfssET8XXodi+N/8JaRTyX34hJTXUPrSloQN TEng==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=5/1ZPz4QRUO/qR4avIcKS9T94CjuqBqu/FTsuMTUF+k=; b=p8vUJwuF8oLWCmG+MGNCV4YC9vpPuPKOhq8iPATyEb8RVCRebJkXORn2B9T5+RTPk/ 9cxsPcSvXyz+saFxMXNCYW9prwdUIGWMHG+ReCK25pd4B05aLk70jbfODnIctgg1kbAs TUZqDHQL1S4qHaPS1z3F8h9uowNimI405aaf7R59F5sg/rhInTMK0XZS7NnryCLrYd+O i4mJAmjsT/kdr5zk3i5YwC/MsW2v+yf5oDoIjoNeCcTTFZWLrYihotJmVFF84PbIUdSu jVWjUzA2qtaQ3jHAdAtR8iaUfVe4PezLpA0HyXlBsHfPM+91lHcocjJ9IcDyBVMic2Hb voQQ==
X-Gm-Message-State: AN3rC/6W+5kVcfHOB/bg9h/jBCZRsFSFIAU5/yF8I1/ncvCwYYWkU5My GA3x/D5ZQlaeJg4fUV+q1hn7fYet2g==
X-Received: by 10.25.31.14 with SMTP id f14mr11521326lff.43.1493860517833; Wed, 03 May 2017 18:15:17 -0700 (PDT)
MIME-Version: 1.0
Received: by 10.46.83.2 with HTTP; Wed, 3 May 2017 18:15:16 -0700 (PDT)
In-Reply-To: <CACsn0c=Q94c=Bk-P=FEZOmR6v1odcKfoq3Q89qADjuv1KH4ysg@mail.gmail.com>
References: <CAAF6GDcKZj9F-eKAeVj0Uw4aX_EgQ4DuJczL4=fsaFyG9Yjcgw@mail.gmail.com> <cb518e35-c214-d11d-a068-c454b2e7ea6a@gmx.net> <CAAF6GDfQ+YXV4gvhBOOZKC=wtYhxQUy1_2_M+dgfbdL25pppiQ@mail.gmail.com> <CABkgnnUwTe627vY=hoLTRv1qmFQLf8ba64X8xHwYdtw7WYn5jw@mail.gmail.com> <CACsn0c=Q94c=Bk-P=FEZOmR6v1odcKfoq3Q89qADjuv1KH4ysg@mail.gmail.com>
From: Martin Thomson <martin.thomson@gmail.com>
Date: Thu, 04 May 2017 11:15:16 +1000
Message-ID: <CABkgnnURuESnxDsacYDQfmuv1vQx4oevj9Mm2_KHvmOCAmGUEg@mail.gmail.com>
To: Watson Ladd <watsonbladd@gmail.com>
Cc: Colm MacCárthaigh <colm@allcosts.net>, "tls@ietf.org" <tls@ietf.org>
Content-Type: text/plain; charset="UTF-8"
Archived-At: <https://mailarchive.ietf.org/arch/msg/tls/9ijSpjSwtNoHWu86cA6QRbmCaUQ>
Subject: Re: [TLS] Security review of TLS1.3 0-RTT
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 04 May 2017 01:15:21 -0000

On 4 May 2017 at 11:11, Watson Ladd <watsonbladd@gmail.com> wrote:
> Historically TLS protected against replay attacks. Now it doesn't. An
> application that relies on this property which TLS used to guarantee
> is now broken. Clearly we could have provided it, we just chose not
> to.

Let's get the fallacy out of the way.  TLS 1.3 provides protection
against replay attacks, just not if you decide to use 0-RTT.

I realize that there is a real risk that this distinction will be lost
on some, but I can fairly confidently say that it isn't lost on those
who are considering its use in various protocols.  For instance, I've
spoken to someone who is looking at XMPP seriously and the advice
there is pretty close to *don't* use 0-RTT.

v2.23.0 | Report a Bug | By Email