Re: [TLS] FYI, a subverted implementation attack against TLS a t ia.cr/2020/1452

Bill Frantz <frantz@pwpconsult.com> Wed, 25 August 2021 22:26 UTC

Date: Wed, 25 Aug 2021 18:26:47 -0400
From: Bill Frantz <frantz@pwpconsult.com>
To: tls@ietf.org
In-Reply-To: <2fe06f8f-f0ac-40d5-ab91-f5053b5b9bcc@www.fastmail.com>
Message-ID: <r480Ps-10146i-84392925FDD14E2DA8617C1BC920CB98@Williams-MacBook-Pro.local>
MIME-Version: 1.0
Content-Type: text/plain; charset="UTF-8"; format="flowed"
Content-Transfer-Encoding: quoted-printable
Archived-At: <https://mailarchive.ietf.org/arch/msg/tls/BZcq2D_wbdYet--7IL5ssOEtVAg>
Subject: Re: [TLS] FYI, a subverted implementation attack against TLS a t ia.cr/2020/1452
Precedence: list

On 8/26/21 at 6:01 PM, mt@lowentropy.net (Martin Thomson) wrote:

>That Signal was hard is interesting, but I don't think that the 
>authors were sufficiently creative.  They say "these 
>low-bandwidth attacks cannot be used to leak the short-term, 
>ephemeral keys", but I don't think that is true at all.  I'll 
>leave it as an exercise for the reader, but I believe it to be 
>trivial to have all keying material available to the observer 
>if an endpoint is cooperative.

And remember, you don't have to exfiltrate the whole key to make 
the exhaustive search problem much easier.

Cheers - Bill

-------------------------------------------------------------------------
Bill Frantz        | The first thing you need when  | Periwinkle
(408)348-7900      | using a perimeter defense is a | 150 
Rivermead Rd #235
www.pwpconsult.com | perimeter.                     | 
Peterborough, NH 03458

[TLS] FYI, a subverted implementation attack agai… Dan Brown
[TLS] Re: FYI, a subverted implementation attack … Martin Thomson
Re: [TLS] FYI, a subverted implementation attack … Bill Frantz