Re: [TLS] Another IRINA bug in TLS

[Watson Ladd <[e-mail]>]

On Sat, May 23, 2015 at 9:35 PM, Jeffrey Walton <[e-mail]> wrote:
> On Sat, May 23, 2015 at 8:36 PM, Watson Ladd <[e-mail]> wrote:
>> On Fri, May 22, 2015 at 1:05 PM, Jeffrey Walton <[e-mail]> wrote:
>>> ...
>>> I don't think browsers will ever be able to handle anything other than
>>> low value data, so I probably won't have to worry about web browsers
>>> and what do (or don't) validate before use.
>>
>> Web browsers handle bank account information, tax returns, user
>> accounts, etc for billions of people. Hard to think of a more
>> high-importance target.
>
> Ah, this is a very good point. I just call it "drinking the koolaide".
>
> SSL was originally designed for ecommerce transactions. In ecommerce,
> risk is offloaded onto merchants and share holders. When something
> goes wrong, its the merchants and share holders who pay.
>
> After inception, SSL/TLS was repurposed for additional uses, but the
> risk model was not the same. For example, someone in Iran may use
> SSL/TLS to access their Gmail account, and that account may have email
> threads with views that are not popular with the current regime. But
> the risk was not offloaded, and lots of people were likely tortured
> and killed because of Diginotar.

Are we talking about phishing? No, we're not.

Are we talking about CA compromise? No, we're not.

The bugs we are discussing involve core security claims: that knowing
the private key associated to one end of a TLS connection is required
to know what data is sent. It's a problem that every single use of
cryptography faces. And it's trivially solvable: SSH has far fewer of
these problems. (It has other problems: check what your hostkeys are
people! If you generated them two decades ago, time to rotate)

So what exactly are you proposing as the solution, if you want to
protect all data? Or is this working group just not worth it: we would
need the Very Serious Security Protocol for you to actually think that
it's worth fixing this problems and sharing your infinite wisdom? I'm
well aware of how TLS got designed: SSH v1 also had tons of problems,
but SSH v2 fixed them all. IKEv1 had problems, IKEv2 fixed them all.
That's the point of having these new versions.

Of course, once you actually have the VSSP, you can just use it for
*all* your data, and replace TLS, SSH, etc. with it. Maybe instead of
quietly fixing holes, you should let all of us know about them, and we
should fix them.

Sincerely,
Watson Ladd


-- 
"Man is born free, but everywhere he is in chains".
--Rousseau.