Re: [TLS] Finished stuffing/PSK Binders

Hugo Krawczyk <hugo@ee.technion.ac.il> Sun, 09 October 2016 20:24 UTC

Return-Path: <hugokraw@gmail.com>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B6A4F1295BD for <tls@ietfa.amsl.com>; Sun, 9 Oct 2016 13:24:08 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.597
X-Spam-Level:
X-Spam-Status: No, score=-2.597 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, FREEMAIL_FORGED_FROMDOMAIN=0.001, FREEMAIL_FROM=0.001, HEADER_FROM_DIFFERENT_DOMAINS=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hOrqEAETYFVy for <tls@ietfa.amsl.com>; Sun, 9 Oct 2016 13:24:06 -0700 (PDT)
Received: from mail-yw0-x22d.google.com (mail-yw0-x22d.google.com [IPv6:2607:f8b0:4002:c05::22d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 104EF12944A for <tls@ietf.org>; Sun, 9 Oct 2016 13:24:06 -0700 (PDT)
Received: by mail-yw0-x22d.google.com with SMTP id u124so60294903ywg.3 for <tls@ietf.org>; Sun, 09 Oct 2016 13:24:06 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:sender:in-reply-to:references:from:date:message-id :subject:to:cc; bh=CmNI5mFDv8bnXQwUNk9ZLOiO4g44EnzCw48hoI8+rFI=; b=kR1+6/oOr+zv4pLgA3QUofOuOz167xPaLpY8xrNtgpMJxtpIAej42o4TQTHcs3PzDN DPwtmYiuicFQPkgfM+t1MnFv5zfCj0MFB/NyE6nF4t051Cw1FPqYTRSVMIxEjv+NW6Gj WWaTlpMmchKG5b4wifeKNFvJVI5fzIr0OaZ4W0gq6CPE2cgYgir4Sau8jjDopkcXXC1U 28EsBM55fEgBx+aezw+d0+hbcRGf776ljaV6L2f7zro61ltBsk5HJ248+nIIT+AOQnNq 8XYWxlBvtJMbNXnnfNc53X7OAPn4O1/v9QqcXgz3oT8ZsWWmivO9oNKIUwxgvu84TrM2 MnBA==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:sender:in-reply-to:references:from :date:message-id:subject:to:cc; bh=CmNI5mFDv8bnXQwUNk9ZLOiO4g44EnzCw48hoI8+rFI=; b=D/wtjvsno1EMqsGZmR+SWEG0/LczN4MivVJD9peHXmGFsMlsA48mKVN0+gWfqU89OY jSKIpRWXfD7MhkeejMa3R+O2L/uSbpirOxNHEIzXPhADoIQSc9xYCbpxGnITFLxqObcf cjSjNoNjHREaK/yAuqilZrv3o/QrCwe5/l7f9RFFioA5WNyQyPfKWRm8LMIn++xy/h2E EFpdlx64fNRQG1ERALopkuHjoSjSdtM2rnmMfO2sPo8D5xjj779q4QJl6GpZntUUdK4C xqiB4QPVQ9sd/ceUZhZixmxlF+6tGJLTN2zbOcxdWXZxLgU0RQfNKsrkcbn14SwcddRI Tu8g==
X-Gm-Message-State: AA6/9RlSYb8OPAhBCs+ek/cfi8P+p5Z9hrowBP+dwJinnOArNBhKRhwzOR1PvkONm6ggALiZdC6rzI0Jmu8DKA==
X-Received: by 10.13.249.135 with SMTP id j129mr26850055ywf.267.1476044645253; Sun, 09 Oct 2016 13:24:05 -0700 (PDT)
MIME-Version: 1.0
Sender: hugokraw@gmail.com
Received: by 10.37.37.132 with HTTP; Sun, 9 Oct 2016 13:23:34 -0700 (PDT)
In-Reply-To: <CABcZeBNp6wjxHBQ+io2Pcwd364=iiobKp-UHZZxOYZbmR7X7AQ@mail.gmail.com>
References: <CABcZeBOJPz8DY92LE6531xbRYLU-Wvkqeb-vTX59gU5rYcp+Ww@mail.gmail.com> <20161007152628.GA9408@LK-Perkele-V2.elisa-laajakaista.fi> <CABcZeBO5HEJAm=QO2NjEWHAH_mKBUBoPn0=Zw5mtKmVz9SP=wQ@mail.gmail.com> <20161007170323.GA9856@LK-Perkele-V2.elisa-laajakaista.fi> <CABcZeBNp6wjxHBQ+io2Pcwd364=iiobKp-UHZZxOYZbmR7X7AQ@mail.gmail.com>
From: Hugo Krawczyk <hugo@ee.technion.ac.il>
Date: Sun, 9 Oct 2016 16:23:34 -0400
X-Google-Sender-Auth: v-e1oG-7Mr2Mhw8xG-LhxVABAzs
Message-ID: <CADi0yUMd4dzofX34Sr-6OLnBYZd2+tkwbJEYVYMuaRFObeYX0g@mail.gmail.com>
To: Eric Rescorla <ekr@rtfm.com>
Content-Type: multipart/alternative; boundary=94eb2c082696c0ca30053e746c27
Archived-At: <https://mailarchive.ietf.org/arch/msg/tls/FWjmaDT5qtmHy7d8plHhzxDZCZw>
Cc: "tls@ietf.org" <tls@ietf.org>
Subject: Re: [TLS] Finished stuffing/PSK Binders
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.17
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sun, 09 Oct 2016 20:24:08 -0000

On Fri, Oct 7, 2016 at 1:08 PM, Eric Rescorla <ekr@rtfm.com>; wrote:

>
>
> On Fri, Oct 7, 2016 at 10:03 AM, Ilari Liusvaara <ilariliusvaara@welho.com
> > wrote:
>
>> On Fri, Oct 07, 2016 at 09:35:40AM -0700, Eric Rescorla wrote:
>> > On Fri, Oct 7, 2016 at 8:26 AM, Ilari Liusvaara <
>> ilariliusvaara@welho.com>;
>> > wrote:
>> >
>> > > On Fri, Oct 07, 2016 at 08:01:43AM -0700, Eric Rescorla wrote:
>> > > > 4. I've taken a suggestion from David Benjamin to move the
>> negotiation
>> > > > of the PSK key exchange parameters out of the PSK itself and into a
>> > > > separate message. This cleans things up and also lets us drop the
>> > > > currently non-useful auth_mode parameter.
>> > >
>> > > Eeh... From the text, it seems to currently require the kex modes
>> > > extension if PSK extension is present. Which seems worse than useless
>> > > if the meaning is to get rid of the kex mode parameter from PSK
>> > > extension (since you will have the value anyway, but need to dig it
>> > > from another extension... Blech).
>> >
>> > I guess this is a matter of taste, but what convinced me was that:
>> >
>> > 1. It put all the logic on the server side.
>> > 2. It removed the auth mod parameter.
>> >
>> > Maybe david can say more.
>>
>> I mean if server is to accept PSK, it must now go fishing for another
>> extension, check that it is present and pay attention to values there.
>> As opposed to having the data in where it is needed.
>>
>
> This is a reasonable argument (and the reason I stuffed the binder here).
> However, David's argument was that this applied to *all* PSKs even new
> ones.
>
>
> -Ekr
>
> > > Also, didn't notice what prevents pathology like this (I presume this
>> > > is not allowed):
>> > >
>> > > (Assume PSK with 0RTT allowed, using AES-128-GCM-SHA256)
>> > >
>> > > ClientHello[Ciphers=CHACHA20-POLY1305-SHA256, EarlyDataIndication]
>> --->
>> > > [0-RTT data, encrypted using AES-128-GCM-SHA256]
>> > > <-- ServerHello[Cipher=CHACHA20-POLY1305-SHA256]
>> > > <-- EncryptedExtensions[EarlyDataIndication]
>> > >
>> > > Note the record protection algorithm mismatch.
>> > >
>> >
>> > Yes, this is forbidden by the combination of:
>> >
>> > "The parameters for the 0-RTT data (symmetric cipher suite,
>> > ALPN, etc.) are the same as those which were negotiated in the
>> connection
>> > which established the PSK.  The PSK used to encrypt the early data
>> > MUST be the first PSK listed in the client's "pre_shared_key"
>> extension."
>> > (though I think I just recently added cipher suite).
>> >
>> > and:
>> > "Any ticket MUST only be resumed with a cipher suite that is identical
>> > to that negotiated connection where the ticket was established."
>>
>> If 0-RTT is used with manually provisioned PSKs (might not be allowed
>> currently, but might be allowed soon), does that still hold?
>>
>> Also, I think it is problematic that externally provisioned PSKs can
>> be used with any protection with given prf-hash, while NST-provisioned
>> PSKs can only be used with one protection and prf-hash.
>>
>> 0-RTT requirements are separate matter, since those would apply to all.
>>
>> The original purpose of resumption-as-PSK was AFAIK to unify the two
>> mechanisms to simplify things. Therefore those two should be as similar
>> as possible.
>>
>> >
>> > Also, to straightforwardly prove that collision resistance of HKDF and
>> > > HMAC (as used) follows from collision resistance of the underlying
>> hash
>> > > function, yon need to take the output to be at least the hash output
>> > > size. As otherwise it is not guaranteed that any collision in HKDF or
>> > > HMAC can be reduced into collision of the underlying hash.
>> > >
>> >
>> > Right. I have some text here but please feel free to suggest more.
>>
>> Yes, but the text says 256 bit output is enough. One isn't guaranteed
>> to be able to reduce such collision to collision of >256 bit hash.
>>
>> (In fact, if the hash is e.g. 384 bit, 256-bit collisions are extremely
>> unlikely to reduce).
>>
>
> Right. I can update.
>


​
​I think that allowing truncation (e.g. for SHA-512) with at least 256-bit
output should be fine too without forcing implementations to work with,
say, 512-bit keys.
While I agree that we don't have generic reductions from collision
resistance of a hash function to its truncations, such (long enough)
truncations are believed to inherit collision resistance. For example,
SHA-512 is "officially" allowed to be truncated and it is the way SHA-384
is defined. Also, a collision on a 256-bit truncated output would be a
MAJOR weakness for any hash function, in particular "breaking" the
treatment of the function as a random oracle (such weakness must lead to
abandoning that hash function).

What do cryptanalysts think?

Hugo
​
 ​


>
> -Ekr
>
>
>>
>>
>>
>> -Ilari
>>
>
>
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls
>
>