Re: [TLS] Fwd: Re: AD review of draft-ietf-tls-dtls-connection-id-07

Achim Kraus <achimkraus@gmx.net> Sun, 11 October 2020 18:12 UTC

Return-Path: <achimkraus@gmx.net>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0CD413A0F19 for <tls@ietfa.amsl.com>; Sun, 11 Oct 2020 11:12:38 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.313
X-Spam-Level:
X-Spam-Status: No, score=-2.313 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, NICE_REPLY_A=-0.213, RCVD_IN_MSPIKE_H2=-0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=gmx.net
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xqnrUEbfBOvH for <tls@ietfa.amsl.com>; Sun, 11 Oct 2020 11:12:36 -0700 (PDT)
Received: from mout.gmx.net (mout.gmx.net [212.227.17.21]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 73A213A0F18 for <tls@ietf.org>; Sun, 11 Oct 2020 11:12:36 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=gmx.net; s=badeba3b8450; t=1602439951; bh=OC+UfljDzt3FH+vBSsvRDy41VngAQpg65wQBKA3nC1Q=; h=X-UI-Sender-Class:Subject:To:Cc:References:From:Date:In-Reply-To; b=HCJtj8Ad7F7+kXeP0ZftXN1zp0UbUhIDffOfylK+sq5cYZXu2FG+37wqIqNY7/XNi TIKRqHMvY39DB3MT6XDcBvV+6XpOoZX+4xz8J3YDInFdoI2i+sbqUiGT1x9Vv8gZYz CI2DvswR4uwqjbJ9+/GHhNF+65/BpKldWYCmKuVM=
X-UI-Sender-Class: 01bb95c1-4bf8-414a-932a-4f6e2808ef9c
Received: from [192.168.178.100] ([88.64.90.178]) by mail.gmx.com (mrgmx105 [212.227.17.168]) with ESMTPSA (Nemesis) id 1MybGX-1kHa4I1tbJ-00z0La; Sun, 11 Oct 2020 20:12:31 +0200
To: Ilari Liusvaara <ilariliusvaara@welho.com>
Cc: "tls@ietf.org" <tls@ietf.org>
References: <0da9b525-ec78-bef5-6ceb-5f377019ade4@gmx.net> <4ca7c2f9-1e9d-0d16-0089-649f013b4565@gmx.net> <20201008233454.GF89563@kduck.mit.edu> <6185242d-8ba8-2d2f-5938-afad46c2e854@gmx.net> <20201009212240.GK89563@kduck.mit.edu> <fe7eab66-a14a-5f18-46be-7bae471c3b20@gmx.net> <CAOgPGoBWRyqQUNk3JQx2_Cna-7s-A7gENVwW-sh8+tRoJ_=V_Q@mail.gmail.com> <13a821d3-30cc-94b8-842c-22a87d280f09@gmx.net> <20201011075100.GA2518649@LK-Perkele-VII>
From: Achim Kraus <achimkraus@gmx.net>
Message-ID: <1d223b9f-394e-d367-847e-5fe3593c97d2@gmx.net>
Date: Sun, 11 Oct 2020 20:12:30 +0200
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0
MIME-Version: 1.0
In-Reply-To: <20201011075100.GA2518649@LK-Perkele-VII>
Content-Type: text/plain; charset="utf-8"; format="flowed"
Content-Language: en-US
Content-Transfer-Encoding: quoted-printable
X-Provags-ID: V03:K1:v7OAOVoqNJzTLDlC90zCQbfsoX+JFc0EFLPfndN8AG8vW0pYiMl SdmfAsbzckS7uT8urO5Fn8oaS/xgmQaPMS3xdn2j/T6EOTPZHb1w/Sa1WUGbTcUrY0yQHK2 Srat0XSP4paVK2aeC1q90Ed9U7l/IUSOcEGPGDVcd6QOpafXQ8BqTM09cTh6v2fO7gxDUiX BEeSZLfB1NhMIlevNMy0g==
X-UI-Out-Filterresults: notjunk:1;V03:K0:R8Fe9fb/2G4=:zqSCXG4BqbARQkmnCC9ZU9 OWfOo0hPFbGM6Onfqb0ZTr2bLweLAlcoXllnDfJPEIzQ2T8b2vu++8lbT6lSdO+06PdPiH7v4 4GkSfxSzGylggxBL/XHmdO9ElfXRVpuFmdCD5eiZeycHD5PlYang3nE3CuFwl186o0ailrsmo 6FHIuUyB66zTKaP46DDN7xr7QgvW+M4X0he9K7EVSK+sj899ci3jl6L0JTHvHxcGUyKzzsuzw 9DKnu9UISVZrxVokdDkqCr98Kf47Cu9qwN1ut5Wttq8uUA8MkmdDgtxsnYi1sJeuBXnaun/z5 R9avo38jv0SfemEcTKvDTJtJtVXmHEohgCHGTQ77jg7J/atDWNtOcF8FB1vwz1Hpw/vIvaTnj aXro6gr+wgsCPpkUTJ0KXvoLUlJGWF1jFgFwzf44p9zxxzGNrDcaTtnyImFsrs79GIcVToy1B hcw9m/tyP2ZRMPzVE7WvWSgEcI9s77EkjubawcSZFPUvlfhG1zyLFJWpJ07e3OUYLJH98JC0Y 5dKRVda4DwW5GqSA7TGwTqHmf82GFrxdjrC2LP23vs1UxFos08nxG6T08PFnOV3A3Pt0RYOZT J9UPJ9Ti8znJ2dmVcvgPd62uOs76A+dVTCdBRnnJkw5sNfifgX3tV6wjFKHUCy9QVP9WC2VRW 6t7H1G/qJQAI7pZy+nPlLFyfUqemlSolAcfCQciFFTM7CJ3sqmCCOJgAtKkO16JUppPgqI8uu bCcFZJKP3v4AO21vLLb/K0UzpFOmR4kV9MB7/sVN9LHz6uzTiZyJSLBxvkHNiOxP+EwMP1IXN KCgJaBZE1s6HZKUNLCDsMBYgnzJv0yX/75g0fluTFOkf7iL9baFWePnUnWQPwZKP4X9R6yPdG o/4WicgAi4+5sHKUXGK5mrveDwnwRiUYUyNzphPSgwuGJn7nVEt24KqHzJOX3rJyhlCnrS970 3bzEDNhAYGLC6tax5F7IEkoDaxjK3nyi7PAtk0wxe6+Gpojl+Iyzu2v+3mLz9VSHcSTAaJyzj cWP1C12RUq+bPHUHvs/xfXM8ioH1IY6iRo3zB+wk+tQDKgBsO4qqPKPO75KKO134zVDwBedJC 7rUDNVMpL7F1IFZO/6mUCXAHvii5xLB+5IliXYMWVWX2vy1/QBMUFGY8a5XPqXZVb5UCEFZpn 1G3Xqi4GJfpRoMvyDTjF0ahxEJpCE8GyOSIW4x/bohgXYrdOpgEDhD6ehmmzNv6lw4v4PAkVf bymMwbHUvesp93rdk36gc/scxVI+/B+jrzrlWsA==
Archived-At: <https://mailarchive.ietf.org/arch/msg/tls/GTaQpu0jF9EgeVe290fdqZUE538>
Subject: Re: [TLS] Fwd: Re: AD review of draft-ietf-tls-dtls-connection-id-07
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sun, 11 Oct 2020 18:12:38 -0000

Hi Ilari,

> The problem is the follows:
>
> Take the following input to the MAC (MtE case):
>
> <seqnum> 19 FE FD 63 01 00 05 04 00 02 FF 17
>
> There is no way to tell from that input if it is:
>
> - Application record on CID 63 containing 04 00 02 FF, or
> - Application record on CID 63 01 00 05 containing FF.
>

Maybe you check your example?

Does the 1. assume cid-length := 1?
And the 2. cid-length := 4?


The dtls-record will then contain:

(remove cid-length 01, cid-length is NOT encoded in the dtls-record!)

19 FE FD <seqnum> 63 00 05 04 00 02 FF 17

or

(remove cid-length 04)

19 FE FD <seqnum> 63 01 00 05 00 02 FF 17

For me this seems to be different input to the MAC, if the cid-length is
left out. My feeling is, your example proves my opinion, that it's
better to remove the cid-length from the MAC.

best regards
Achim Kraus