IETF Logo Mail Archive

[TLS] Collision issue in ciphertexts.

"Dang, Quynh" <quynh.dang@nist.gov> Mon, 02 November 2015 07:14 UTC

Return-Path: <quynh.dang@nist.gov>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DBDF11B339E; Sun, 1 Nov 2015 23:14:04 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.901
X-Spam-Level:
X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2mOT26vEmjn8; Sun, 1 Nov 2015 23:14:01 -0800 (PST)
Received: from na01-bn1-obe.outbound.protection.outlook.com (mail-bn1on0736.outbound.protection.outlook.com [IPv6:2a01:111:f400:fc10::736]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7D0921B3383; Sun, 1 Nov 2015 23:13:57 -0800 (PST)
Received: from BN1PR09MB124.namprd09.prod.outlook.com (10.255.200.27) by BN1PR09MB123.namprd09.prod.outlook.com (10.255.200.25) with Microsoft SMTP Server (TLS) id 15.1.312.18; Mon, 2 Nov 2015 07:13:40 +0000
Received: from BN1PR09MB124.namprd09.prod.outlook.com ([10.255.200.27]) by BN1PR09MB124.namprd09.prod.outlook.com ([10.255.200.27]) with mapi id 15.01.0312.014; Mon, 2 Nov 2015 07:13:40 +0000
From: "Dang, Quynh" <quynh.dang@nist.gov>
To: Eric Rescorla <ekr@rtfm.com>, "cfrg@ietf.org" <cfrg@ietf.org>
Thread-Topic: Collision issue in ciphertexts.
Thread-Index: AQHRFT3/uhvieo6mr0iE/9qPshn2sQ==
Date: Mon, 02 Nov 2015 07:13:39 +0000
Message-ID: <BN1PR09MB124321AF53FE4EB4F47AFE9F32C0@BN1PR09MB124.namprd09.prod.outlook.com>
References: <CABcZeBODjk8rapgbNTST8bmFFVzKqB4tJyrvje-CTgk1=gfqFw@mail.gmail.com> <CABkgnnV+QrjcXJdZwwAGW-SpX0Z0_JroEVT-kMJgUAVe7DDQUw@mail.gmail.com> <CABcZeBOrL=TosONYfM_QPPYfT5N4VH7yR4hFw3Qt8W4V0uznkw@mail.gmail.com> <CABkgnnXis0mwqcsd1D0S61kqL6kvq9=ZU0BRbwbLH7Jesj0Y-w@mail.gmail.com> <CABcZeBNpV3uqOF4YohiCrtq03hR7LPnPGdny6yWB+zysVufiqA@mail.gmail.com> <CABkgnnWVJeeBuMitweCj=nOSB5cA-R-6btdQeWp0Bdnomd2XtQ@mail.gmail.com> <CAMfhd9V4WVxKbJh6KkNdVFGBGKh=tG5kC_7sPthOwhrrUi5eoQ@mail.gmail.com> <CABcZeBOc_9i83j4rjxve8PuBPWdd8eCVN2wQth3G0=T_xz1UKg@mail.gmail.com> <811734cd29d64adc98c5388870611575@XCH-ALN-004.cisco.com> <CABcZeBNZJkrVsA9UEN-ywpzUOZy4wJ=2=QDg-KhjNUCvMKi=HA@mail.gmail.com>, <CABcZeBNOJNwL9Akbhnpd2fg8rk80BNYRkODRpqDb9nk2K_m1mg@mail.gmail.com>
In-Reply-To: <CABcZeBNOJNwL9Akbhnpd2fg8rk80BNYRkODRpqDb9nk2K_m1mg@mail.gmail.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
authentication-results: spf=none (sender IP is ) smtp.mailfrom=quynh.dang@nist.gov;
x-originating-ip: [2001:c40:0:3032:c010:3a38:d1de:776b]
x-microsoft-exchange-diagnostics: 1; BN1PR09MB123; 5:OysDhTUku/ZcDlr952bIr+5ygzQ7rZOI7tY23Bg39xckQ8C4JxzcTc4LjOilu3k6KrJTO9LpbRmPjzSJvqI8yJT5i2InhvbN3tX4IzAknxnrO2cy5clxr6JzPo4Tn9zQf2xqXnoD09cTc7o4keLFbQ==; 24:rwQ35CQ8yf2fzRQfsoa0buCQ3zkxBeWM1cDnH9o3xWwsQZ9HjEo0IvCSf3CMDnQhpxghKlYHOtp3JKb0HOx0lvNSk1u6K1CS4Lyt2SUd9Yk=; 20:K5RZHh6l9bLcvbeU75mC5nQgNY5k0EQHVlK9rdz9r5MQURKJEM6A/glxLGVIPrcQeUWWAKghvWBwA/HMRZW9rA==
x-microsoft-antispam: UriScan:;BCL:0;PCL:0;RULEID:;SRVR:BN1PR09MB123;
x-microsoft-antispam-prvs: <BN1PR09MB12319E0D55EF664B6E8CDB2F32C0@BN1PR09MB123.namprd09.prod.outlook.com>
x-exchange-antispam-report-test: UriScan:;
x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(601004)(2401047)(5005006)(8121501046)(520078)(3002001)(10201501046); SRVR:BN1PR09MB123; BCL:0; PCL:0; RULEID:; SRVR:BN1PR09MB123;
x-forefront-prvs: 0748FF9A04
x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(6009001)(199003)(189002)(99286002)(105586002)(92566002)(2900100001)(86362001)(5002640100001)(16236675004)(5007970100001)(33656002)(10400500002)(5004730100002)(106116001)(5001920100001)(2501003)(5001960100002)(19627405001)(97736004)(5001770100001)(81156007)(102836002)(74316001)(229853001)(40100003)(5008740100001)(77096005)(122556002)(54356999)(106356001)(189998001)(93886004)(50986999)(87936001)(19625215002)(101416001)(11100500001)(5003600100002)(76176999)(2950100001)(76576001)(3826002); DIR:OUT; SFP:1102; SCL:1; SRVR:BN1PR09MB123; H:BN1PR09MB124.namprd09.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; A:1; MX:1; LANG:en;
received-spf: None (protection.outlook.com: nist.gov does not designate permitted sender hosts)
spamdiagnosticoutput: 1:23
spamdiagnosticmetadata: NSPM
Content-Type: multipart/alternative; boundary="_000_BN1PR09MB124321AF53FE4EB4F47AFE9F32C0BN1PR09MB124namprd_"
MIME-Version: 1.0
X-OriginatorOrg: nist.gov
X-MS-Exchange-CrossTenant-originalarrivaltime: 02 Nov 2015 07:13:39.9265 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 2ab5d82f-d8fa-4797-a93e-054655c61dec
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN1PR09MB123
Archived-At: <http://mailarchive.ietf.org/arch/msg/tls/C4JgfKD4ZcDtFfpVIg2nZwnlxBc>
Cc: "tls@ietf.org" <tls@ietf.org>
Subject: [TLS] Collision issue in ciphertexts.
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 02 Nov 2015 07:14:05 -0000

Hi Eric,


As you asked the question about how many ciphertext blocks should be safe under a single key, I think it is safe to have 2^96 blocks under a given key if the IV (counter) is 96 bits.


When there is a collision between two ciphertext blocks when two different counter values are used , the chance of the same plaintext was used twice is 1^128.  Collisions start to happen a lot when the number of ciphertext blocks are above 2^64. However, each collision just reveals that the corresponding plaintext blocks are probably different ones.



Quynh.

v2.23.0 | Report a Bug | By Email