Re: [TLS] Rizzo claims implementation attach, should be interesting

[Marsh Ray <[e-mail]>]

On 09/19/2011 07:53 PM, Martin Rex wrote:
>
> It seem to be a huge hype an exxageration of the problem.
> There is *no* problem in SSLv3 or TLSv1.0.  This particular attack
> is a very clear "Man-in-the-Browser" attack enabled solely by the
> entirely braindead (lack-of) security in common Web Browsers.
>
> Since the attack happens entirely at the browser, it should IMHO
> the browser's duty to fix this.

Last I checked, the TLS RFC stated explicitly that the protocol defended 
explicitly against man-in-the-middle attacks. It did not say it defended 
against "blockwise-adaptive chosen-plaintext" attacks.

But why split hairs over it? It breaks a basic security properties of 
the system even if the application designer has done everything 
according to the recommendations in the spec. Since when did "trusted 
script only" in the application become a requirement for transport layer 
security?

> Potential server-side mitigation of the problem:
>
>    - disable HTTP request pipelining (aka Connect: keep-alive)

Expensive.

>    - avoid CBC-based cipher suites (at least when SSLv3 or TLSv1.0
>      is negotiated), and use RC4-128 instead.

Does TLS's use of RC4 still take the first bytes after initialization 
with the key? Or does it discard the proper amount?

I believe there was a mitigation put in place by OpenSSL: sending an 
empty (just padding) message before each app data message. The document 
at eprint.iacr.org/2006/136 suggests that this could be a server-side 
only change. I don't see how that would work since the session cookie 
recovery attack is clearly happening on the client->server channel.

I read somewhere that this mitigation was off by default in OpenSSL 
because it some software (an old MSIE IIRC).

Does anyone believe there would be support for a TLS 1.0 Hello extension 
that could compatibly negotiate the use of empty messages in each 
direction as a mitigation for this attack?

I've not been told the details of Duong and Rizzo's attack and haven't 
seen "the BEAST" in action yet, so I'm not sure if that would be 
sufficient to fix CBC in TLS 1.0. I am slightly annoyed at these guys 
for dribbling out the information one hint at a time like this.

- Marsh