IETF Logo Mail Archive

Re: [TLS] PR for anti-downgrade mechanism

Eric Rescorla <ekr@rtfm.com> Mon, 09 November 2015 23:53 UTC

Return-Path: <ekr@rtfm.com>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8AD711ACC91 for <tls@ietfa.amsl.com>; Mon, 9 Nov 2015 15:53:22 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.277
X-Spam-Level:
X-Spam-Status: No, score=-1.277 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001] autolearn=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id T-65T9NPeZG6 for <tls@ietfa.amsl.com>; Mon, 9 Nov 2015 15:53:21 -0800 (PST)
Received: from mail-yk0-x231.google.com (mail-yk0-x231.google.com [IPv6:2607:f8b0:4002:c07::231]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1A5E51ACCEA for <tls@ietf.org>; Mon, 9 Nov 2015 15:53:21 -0800 (PST)
Received: by ykdv3 with SMTP id v3so202488275ykd.0 for <tls@ietf.org>; Mon, 09 Nov 2015 15:53:20 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm_com.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-type; bh=6KzDkuUNbI+wAPaHF7tDr1pPpji68SIE6vY5jaADt5M=; b=wqu8JsaKA+4vHv629fRw55AJJAUGaGHfKzbQrnzaP5uJ28zpCDSf2vTz3ct8DZD1xm Gau3pvgjYyocAzE5tIvQ8vHV9b5Eom+pZ4CQUoaypaYhAxiOdvNfYca/ftdx1XXNn8O+ q8CG+I5MJKQJ/3si5DUhDMDbYEHyOaIjR5wH5vrO0ysvzIn+B8BWeDZQvK3zTL76GGhh YOB/Rp3yo3M0A0t3nXKdrMJz5JDRVXy7hpg811qYxaf9CnIPo6DakOdEn5yMjdECDCxR SAF82F9WQD59ldMGD/zTg/N+eaZnlmE5HR/B0y1g4k37aMgU4xJRn/v2pnUA3jjPoL34 apnA==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc:content-type; bh=6KzDkuUNbI+wAPaHF7tDr1pPpji68SIE6vY5jaADt5M=; b=PJbnX6bXdFSAKwJ81gagT0P7OHK6RzQJbZR9PNKmUlAIyRQVn8vBk9QltowCC8XRP/ SbzXMFK/6rmva10jcIYMedxrEuo8GG1ezWW/OzP1zJhKIh+uRjFiZHLeuj870PZzOLOq BJCUA5er2VhAeAawSvBjn/SynC3XXm5fQdDcn8OfZH73VTY8be+ENSVGjblA9LvhtnQv Ku2wJpNjEkrI/UnkkNKmTsI6qFgIR9Wf3BYEOkiry1Jc9QzfOV+xScdT3PhrJzJ4/xvl ObRh2zONmqV8Hii6dn+KV6XwxySO085Sw9UmPiJ7wgbTgl53PqNS/Bh2yXW5C7HR+eK4 lE8Q==
X-Gm-Message-State: ALoCoQnUJvIhYUDB77J8Okhm8NY1vxppBDYrIpm1wdOUSXjaG6z/5KR33OW9uysfFTT9ObNzHRHZ
X-Received: by 10.129.34.4 with SMTP id i4mr503631ywi.155.1447113200383; Mon, 09 Nov 2015 15:53:20 -0800 (PST)
MIME-Version: 1.0
Received: by 10.13.221.203 with HTTP; Mon, 9 Nov 2015 15:52:40 -0800 (PST)
In-Reply-To: <CABkgnnVRO56392s068xeB_Lnn6qoVu_MBbwWRcKe=p8YPQ2RUw@mail.gmail.com>
References: <CABcZeBOB9mnQ8bLOCSysnx9LMv0hxrPCA21jTnxAMb3Yom_Aow@mail.gmail.com> <201510171708.16547.davemgarrett@gmail.com> <CABcZeBOzJkdjC-NnjPcHtoU_6rmEMPqj4Y7xKuA=CHZLT9r49w@mail.gmail.com> <201510171734.26589.davemgarrett@gmail.com> <CABcZeBNFvUN6KOpzGO5_tPU9dqbJ8q=k_CaqmkjeCR_hS2RCOg@mail.gmail.com> <20151017220548.GF15070@mournblade.imrryr.org> <CABcZeBPhmq+0k8gVs9FcZ6T-_SehqrWkL0BzkB5z8=DgXy1Saw@mail.gmail.com> <20151017221733.GG15070@mournblade.imrryr.org> <CABcZeBOew4DTOzj1Q=G9_o87SjH-hF85VWmz1U38P1WedjkuYg@mail.gmail.com> <20151017230257.GI15070@mournblade.imrryr.org> <84C5B67D-F236-4BFD-AA13-5CC13062B8C5@akamai.com> <CABcZeBMn9=H3A2EpQonB1rM5ApZ68hzdNHRQf6NOU+7C6_iiiA@mail.gmail.com> <CABkgnnVRO56392s068xeB_Lnn6qoVu_MBbwWRcKe=p8YPQ2RUw@mail.gmail.com>
From: Eric Rescorla <ekr@rtfm.com>
Date: Mon, 09 Nov 2015 15:52:40 -0800
Message-ID: <CABcZeBNKetQrBbKR3pSOawg_OyTa8cHsHXjuAUq4Yu4F2d0tcA@mail.gmail.com>
To: Martin Thomson <martin.thomson@gmail.com>
Content-Type: multipart/alternative; boundary="001a11408678426fa50524244cbc"
Archived-At: <http://mailarchive.ietf.org/arch/msg/tls/Gc3KsVhD33gHhtpQA3ryrAyq_5A>
Cc: "tls@ietf.org" <tls@ietf.org>
Subject: Re: [TLS] PR for anti-downgrade mechanism
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 09 Nov 2015 23:53:22 -0000

In an attempt to close the loop here, I've pushed a new PR version with a
64-bit sentinel with the final byte being 00 for TLS 1.2 and 01 for TLS
1.3. If anyone strongly objects to this construction, please raise your
hand now.

Otherwise, I plan to merge this on Wednesday.

https://github.com/tlswg/tls13-spec/pull/284

-Ekr



On Mon, Oct 19, 2015 at 10:05 AM, Martin Thomson <martin.thomson@gmail.com>
wrote:

> On 19 October 2015 at 08:08, Eric Rescorla <ekr@rtfm.com> wrote:
> > overloading the time field
> > lowers the risk of false positives because we can choose a sentinel that
> > will never
> > collide with a conformant TLS 1.2 ServerHello. By contrast, a sentinel in
> > the
> > randomly generated portion always has a 2^{-n} chance of collision.
>
> Yes, this is right.  The marginal gain is that the proportion of
> servers that generate a time here are immune to collisions.  If
> servers all servers did that, we wouldn't have to worry about
> collisions at all. Unfortunately, we do know that some generate random
> values.
>

v2.23.0 | Report a Bug | By Email