Re: [TLS] TLS 1.3 : small fragments attack

[Jitendra Lulla <[e-mail]>]

 The pattern is perfectly normal and might be assumed to be coming from an interactive terminal.
But what if such records, from the same session, come in a quantity of 10000 or more per second which could be generated by uploading a 500 MB file by the client?
And how about 100s of such clients targeting a server which is allowing file uploads?
The server can be very easily kept busy decrypting and HMAC verifying such records just to obtain 1 real application data byte per record while the remaining 308 bytes are just overhead of securing the said byte!


--------------------------------------------
On Sat, 12/30/17, Peter Gutmann <[e-mail]> wrote:

 Subject: Re: [TLS] TLS 1.3 : small fragments attack
 To: "[e-mail]" <[e-mail]>, "Jitendra Lulla" <[e-mail]>
 Date: Saturday, December 30, 2017, 5:03 AM
 
 Jitendra Lulla <[e-mail]>
 writes:
 
 >The client can have a
 rogue TLS implementation with the following intentional
 >changes:
 >
 >0. Choose CBC with AES256-SHA56 or any
 other heavier (in terms of processing
 >power requirements) and non
 paralleliz'able  cipher suite.
 >
 >1. After the handshake, always send all the
 TLS records (Application Data)
 >plain
 text fragment size which is no greater than 1 Byte.
 >
 >2. Always send a
 padding of max possible or big size (eg 256 Bytes)
 
 Apart from (2), that looks
 like interactive terminal traffic over TLS.  The
 large padding may also be natually sent by an
 implementation that's trying a
 bit too
 hard to hide typing/traffic patterns.
 
 Peter.