Re: [TLS] padding bug

[Nikos Mavrogiannopoulos <[e-mail]>]

On 09/08/2013 04:59 AM, Peter Saint-Andre wrote:

>> As I recall there were three proposals for resolving the padding
>> bug in TLS
> 
>> 1.       An extension for Pad First (i.e. padding before an
>> otherwise standard TLS mode of operation)
> 
>> 2.       An extension for Encrypt-then-MAC (i.e. this draft)
> 
>> 3.       The replacement of each existing cipher suite with an 
>> equivalent AEAD one
> 
>> Was any consensus achieved as to the best approach?
> 
> I never saw further discussion on this topic. Are there I-Ds for each
> approach? #3 seems onerous to me (and doubling the number of cipher
> suites doesn't seem like a desirable outcome), and as far as I can
> tell there's no specification for #1. Although I am not a TLS expert,
> the Encrypt-then-MAC I-D referenced above seems reasonable, it neatly
> solves a real-world problem, and we have running code; thus IMHO
> formalization of this approach deserves to be considered in the WG.

It is important when trying to solve an issue not to introduce new
issues. The current proposal for #2 unfortunately does not take into
account known counter-measures for key recovery attacks in MACs (see [0]).

regards,
Nikos

[0]. http://www.ietf.org/mail-archive/web/tls/current/msg09520.html