Re: [TLS] Channel ID and server load: comment on draft-balfanz-tls-channelid-00

[Adam Langley <[e-mail]>]

On Tue, Oct 22, 2013 at 1:52 PM, Watson Ladd <[e-mail]> wrote:
> Completely spurious: hardware (or a separate process) does not know
> whether it is being asked to provide
> the ChannelID for a request that is genuine or one that the attacker
> provided after subverting the browser process.

Certainly that's true. However, it limits the attacker to an online
attack: closing the laptop etc stops them. That's a lot better than
the current situation where cookie theft is a significant problem.

Additionally, ChannelID can be extended to an "ignition key" model
where connections need to reprove the presence of the ChannelID every
$n minutes. (That might get the verification load to the point where
batching is useful :)

> There also is a replay attack: a signature of a static string provides
> no liveness

ChannelID signs the handshake which includes an nonce from the server.

> Because of a stupid missing bit, you don't know which of two points
> lead to the r value. If you did know this bit, you could
> make the verification equation an identity in the curve and apply the
> Bos-Coster trick Ed25519 does. I've not come up with
> a way around this issue. Guess and check isn't worth it: it ends up
> costing more than verifying one at a time.

I have not looked into batching ECDSA verifies but [1] seems quite
clear that it's dealing with unmodified ECDSA signatures (paywalled
I'm afraid, but the first two pages are free). They report a speedup
of 2x for batches with multiple signers, which is roughly equal to the
reported speedup for Ed25519 (273K -> 134K cycles).

[1] http://rd.springer.com/chapter/10.1007%2F978-3-642-31410-0_1


> Fair enough: I assume P256 is performant enough for the applications
> being imagined, but given
> the constant kvetching about performance, I'm not sure everyone shares
> that. (Then again, they
> kvetch while using interpreted languages...)

I am not terribly happy with the performance implications of ChannelID
either, but we're still exploring our options.


Cheers

AGL