Re: [TLS] What would make TLS cryptographically better for TLS 1.3

Hi,

Renegotiation is a critical feature of TLS, which serves multiple purposes.

>
> * Renegotiation allows rekeying of a session.  This is absolutely
> required for any ciphersuite based on a block cipher with a 128-bit or
> smaller block, because block cipher modes' security properties degrade
> after they are used for more than some number of blocks.
>

Can you be more specific about 'some number of blocks'? This number is
astronomically large. Reconnect the TLS if you have to.

>
> * Applications can also use renegotiation-based rekeying to improve
> forward secrecy; for example, the Mixminion specification
> (<
> https://github.com/nmathewson/mixminion-doc/blob/a661212831d2afc3200339b2634ca16452e3aeec/spec/minion-spec.txt
> >,
> section 4, line 1040) requires that relay-to-relay TLS connections be
> rekeyed using renegotiation every 15 minutes for this purpose.
>

Mixminion falsely assume  that the security degrades if a connection is
live for more than 15 minutes. That's security wise not true. In today's
security design (TLS) the negotiated session key material is secure for
years (if not decades). Gone are the times when DES was used and DES could
be cracked in 24h and it was desirable to use a new DES key every 24 hours.
Gone. Gone Gone.

If you negotiate session keys that could be cracked within a year you
should not have negotiated those sessions keys in the first place.

> * A TLS connection can be established by a fully trusted device which
> knows a password or other application-layer authorization credential,
> authorized to perform some operations using messages within the TLS
> connection, and then transferred with the help of renegotiation to a
> less trusted device to actually perform those operations.  This is
> similar to the preceding use, but to provide 'sideways secrecy' rather
> than forward secrecy.
>

Renegotiation comes at a huge cost of complexity (not just from a
development point of view but also from a security audit point of view).
All features of re-negotiation can be achieved by re-connecting.
Re-connecting is well understood, easily tested and audited.

>
> * One version of the Tor 'link protocol' (Tor's term for its outer
> TLS-based connection protocol) uses renegotiation to provide secrecy
> for the server's certification chain against purely passive attackers.
>  The purposes above could be served by applying a one-way function to
> the originally derived key material, then discarding the old keys;
> this purpose cannot.
>

reconnect!

regards,

ralf

>
>
> Robert Ransom
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls
>