Re: [TLS] Changes to draft-ietf-tls-dtls-heartbeat resulting from IESG review

[Nikos Mavrogiannopoulos <[e-mail]>]

On Mon, Dec 5, 2011 at 6:04 PM, Dan Harkins <[e-mail]> wrote:

>>> One of the requested changes was to randomize to the data in the
>>> heartbeat message to attempt to head of any issues occurring from weak
>>> or flawed ciphers.   Since the change was relatively simple, the
>>> document was modified even though modern ciphers should not have a
>>> problem.  Flaws may be discovered in one of the many cipher suites in
>>> the future.
>> Are there any papers or cipher documentation discussing how using
>> randomized data in a packet would solve possible future cipher flaws?
>  Check out "Deterministic Authenticated Encryption"* by Rogaway and
> Shrimpton. It defines a cipher mode for key-wrapping but the proof of
> security (appendix C) is based on the notion of randomized data in the
> packet-- i.e. that part of the data (the key) being wrapped is random.

Indeed, but this is not a generic encryption mode like CBC or CTR. It
is specifically designed to encrypt random keys, and thus depends on
its randomness. Typical encryption modes are specifically designed to
prevent someone distinguishing a given plaintext encryption from a
random one.

Now, if one would like to use a subliminal channel in TLS, the
heartbeat extension now provides an unbounded channel.

regards,
Nikos