Re: [TLS] Comments/Questions on draft-gutmann-tls-encrypt-then-mac-00.txt

[Peter Gutmann <[e-mail]>]

Eric Rescorla <[e-mail]> writes:

>Do you think you could address the questions I asked below?

Sorry, given the email avalanche recently and the fact that I wasn't sure what
the questions were getting at, I'd put them in the TODO list.

> - Because this draft relies on extensions, it seems not to resist
>   active attack when clients do insecure version fallback
>   (see for instance:
> http://www.ietf.org/mail-archive/web/tls/current/msg09468.html)

Right, but given that the problem is broken clients I'm not sure what the
issue is.  Anything that falls back to older, less secure versions of
protocols is going to be vulnerable to things that the newer protocols fix.

> - Maybe I am misreading the draft, but I'm unclear on how you get
>    the TLSCompressed.length for the MAC computation in Section 3.
>    Does this have the same issue as was raised for McGrew's CBC AEAD
>    draft?

What was the issue raised for the AEAD draft?  Since I'm not sure what the
question is asking, the only real response I can give is that there's a number
of implementations out there that interoperated without problems, so whatever
the perceived problem is, it doesn't seem to be much of an issue.

Peter.