IETF Logo Mail Archive

Re: [TLS] Choice of Additional Data Computation

Thomas Fossati <Thomas.Fossati@arm.com> Sat, 25 April 2020 10:41 UTC

Return-Path: <Thomas.Fossati@arm.com>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DCF823A0A01 for <tls@ietfa.amsl.com>; Sat, 25 Apr 2020 03:41:15 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.899
X-Spam-Level:
X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, SPF_PASS=-0.001, UNPARSEABLE_RELAY=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=armh.onmicrosoft.com header.b=y/0AP4b0; dkim=pass (1024-bit key) header.d=armh.onmicrosoft.com header.b=y/0AP4b0
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NBmfIQqOz2Y2 for <tls@ietfa.amsl.com>; Sat, 25 Apr 2020 03:41:14 -0700 (PDT)
Received: from EUR01-DB5-obe.outbound.protection.outlook.com (mail-eopbgr150053.outbound.protection.outlook.com [40.107.15.53]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C21183A09F1 for <tls@ietf.org>; Sat, 25 Apr 2020 03:41:13 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=armh.onmicrosoft.com; s=selector2-armh-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=FhnETYQw/Y5tm3E0WDf70VrLPRJkeFUOjVlzs+7y3Rk=; b=y/0AP4b0KB+jr64DVQB86DntMC8dwDmmtjU/OMDz6YdRatP1pT5v0uVBY1dMRHACdgh0aQphs65Whd0dgsz8w53r5OylPzUiQTS/yoYGWQ0kj4J405yU6TJXKZSle+2I0JInK7F1MHcABLLyeuhWWqpWVwboUM/h+VZnZgrRUjY=
Received: from AM6PR10CA0098.EURPRD10.PROD.OUTLOOK.COM (2603:10a6:209:8c::39) by AM0PR08MB3139.eurprd08.prod.outlook.com (2603:10a6:208:5d::16) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2937.13; Sat, 25 Apr 2020 10:41:11 +0000
Received: from VE1EUR03FT054.eop-EUR03.prod.protection.outlook.com (2603:10a6:209:8c:cafe::7b) by AM6PR10CA0098.outlook.office365.com (2603:10a6:209:8c::39) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2937.13 via Frontend Transport; Sat, 25 Apr 2020 10:41:11 +0000
Authentication-Results: spf=pass (sender IP is 63.35.35.123) smtp.mailfrom=arm.com; ietf.org; dkim=pass (signature was verified) header.d=armh.onmicrosoft.com;ietf.org; dmarc=bestguesspass action=none header.from=arm.com;
Received-SPF: Pass (protection.outlook.com: domain of arm.com designates 63.35.35.123 as permitted sender) receiver=protection.outlook.com; client-ip=63.35.35.123; helo=64aa7808-outbound-1.mta.getcheckrecipient.com;
Received: from 64aa7808-outbound-1.mta.getcheckrecipient.com (63.35.35.123) by VE1EUR03FT054.mail.protection.outlook.com (10.152.19.64) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2937.19 via Frontend Transport; Sat, 25 Apr 2020 10:41:08 +0000
Received: ("Tessian outbound 4cdf5642225a:v54"); Sat, 25 Apr 2020 10:41:08 +0000
X-CheckRecipientChecked: true
X-CR-MTA-CID: 40eadf2ace2dd633
X-CR-MTA-TID: 64aa7808
Received: from 1a7b04ba0168.2 by 64aa7808-outbound-1.mta.getcheckrecipient.com id F35D2151-01AB-4600-9247-81E091BEB0ED.1; Sat, 25 Apr 2020 10:41:02 +0000
Received: from EUR05-AM6-obe.outbound.protection.outlook.com by 64aa7808-outbound-1.mta.getcheckrecipient.com with ESMTPS id 1a7b04ba0168.2 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384); Sat, 25 Apr 2020 10:41:02 +0000
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=BP2AEEVNf5WFFQ4zd3f3r7/FwmqnbTGbG6vB6FFiEUB5dmPGaphmx+p+bdu+bq3L6fzWkx/xg2eEwnVyr9PokvGIkSbc47FWEvB2kKwx60JnzHgYHyR44N8PF94TPcvi2wHMgJSDISz834leGvS6A1ETQcI2XSenWJe3eVvxTMC6LvLJ5mJtH4Fb5iO+i558oMUYnTB0zoe7fltMXi7trc9CamRFQ0hit/eFxDLCSEkVXAtixWBips/kjOD8H5PNcld1MSKYsHx9LD7dBObOlFHJwphs17bnzQ4vrZDxhnS3z1+/L57aesJhhdSZG4iu9dN4y7/ddiJBhXRsoPdvbA==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=FhnETYQw/Y5tm3E0WDf70VrLPRJkeFUOjVlzs+7y3Rk=; b=ELiVLHDNo2GhbjKgP4ZPyXKVJ9DujAKLD0ccBLiq6Rv+H8iqKz/q8UuAS9FmFUDVBtdCG5hNcp2MbAxDjuDT+fj8n5nObHdyJxjsIxGntFq5fdXeEvqy3q3El+wOeu8CEuVCVYZ/lDXhvUqktYwRodzGTC++HNNyYpXetvwkTpNYpzv0NrqP7rzeRfxbixNcn5mrh9LMs1gKnVhGfAR0zm4pLecrKO4c1ZUX560Guw3uUDsQrnxehplCqDPXG/fXro5q7EAWjJZ+DMysBB4W/bnLau7hgTs5UPibd/ODTD7wfgZbFeIDFGzsKsaJ7Ov8zlJ9ysqapZ0S03PwJEu2Ig==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=arm.com; dmarc=pass action=none header.from=arm.com; dkim=pass header.d=arm.com; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=armh.onmicrosoft.com; s=selector2-armh-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=FhnETYQw/Y5tm3E0WDf70VrLPRJkeFUOjVlzs+7y3Rk=; b=y/0AP4b0KB+jr64DVQB86DntMC8dwDmmtjU/OMDz6YdRatP1pT5v0uVBY1dMRHACdgh0aQphs65Whd0dgsz8w53r5OylPzUiQTS/yoYGWQ0kj4J405yU6TJXKZSle+2I0JInK7F1MHcABLLyeuhWWqpWVwboUM/h+VZnZgrRUjY=
Received: from AM6PR08MB4231.eurprd08.prod.outlook.com (2603:10a6:20b:73::23) by AM6PR08MB3397.eurprd08.prod.outlook.com (2603:10a6:20b:43::30) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2937.22; Sat, 25 Apr 2020 10:41:01 +0000
Received: from AM6PR08MB4231.eurprd08.prod.outlook.com ([fe80::5e0:a53a:d4d6:2e8d]) by AM6PR08MB4231.eurprd08.prod.outlook.com ([fe80::5e0:a53a:d4d6:2e8d%6]) with mapi id 15.20.2937.020; Sat, 25 Apr 2020 10:41:01 +0000
From: Thomas Fossati <Thomas.Fossati@arm.com>
To: Eric Rescorla <ekr@rtfm.com>, chris - <chrispatton@gmail.com>
CC: "tls@ietf.org" <tls@ietf.org>, Thomas Fossati <Thomas.Fossati@arm.com>
Thread-Topic: [TLS] Choice of Additional Data Computation
Thread-Index: AdYaKASVCp3JPFQuSaOSMkwtz/VZZwAEUEsAAAN7oaAAAnFQAAAASY9CAAFcJQAAAoyFgAAAY+d9AADW9gAAAKxogAAEWbaA///8NYCAAA0dgIAAAW+AgADsegA=
Date: Sat, 25 Apr 2020 10:41:00 +0000
Message-ID: <9B719965-F763-4DDD-9961-56930017EBEC@arm.com>
References: <AM0PR08MB371694E826FA10D25F2BA53EFAD00@AM0PR08MB3716.eurprd08.prod.outlook.com> <93042b37-37e1-5b6a-3578-a750054d0507@gmx.net> <AM0PR08MB3716541F4825F8D43DC3D308FAD00@AM0PR08MB3716.eurprd08.prod.outlook.com> <CACLV2m4-Qcx-xKWP201VCY73HVyjCzHVCb6PrntnBWhA8fBQYg@mail.gmail.com> <AM6PR08MB3318B6ABD411C8C476C3D10B9BD00@AM6PR08MB3318.eurprd08.prod.outlook.com> <CABcZeBOwK7m465LsbY3U+bHv0XA2rcGOTEBStTtTNkwAYvWeQA@mail.gmail.com> <CACLV2m5Md2+Ffc978ZJ+BeZwRgcXTV3xE0vXzmvNgnot_c71xQ@mail.gmail.com> <AM6PR08MB331862B6F143652F4B4C10EE9BD00@AM6PR08MB3318.eurprd08.prod.outlook.com> <CABcZeBMKoVrcN-=aTvy6py5bhOwOVrhgVLmtX2tthc=Oa54b_Q@mail.gmail.com> <CACLV2m7knyt-gQoQq2v1Kz-J62DPjCpb6faJFfDgJ-8mprHwxQ@mail.gmail.com> <CD3D3519-281A-469E-AB5C-FB5E26816958@arm.com> <CABcZeBPJZKOCN7p52htHBERCVVxBJSTvJfOwn5=u6zZJLRfkfQ@mail.gmail.com> <CACLV2m6D=DrHH+66V1HC8RMQytggpkcxutZD=p0GP1dpcqjhVw@mail.gmail.com> <CABcZeBMWKDvNsgeZUFtv7vj0b2vnyhM34YxY4auvkVKHRTP+RA@mail.gmail.com>
In-Reply-To: <CABcZeBMWKDvNsgeZUFtv7vj0b2vnyhM34YxY4auvkVKHRTP+RA@mail.gmail.com>
Accept-Language: en-GB, en-US
Content-Language: en-GB
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
user-agent: Microsoft-MacOutlook/16.36.20041300
Authentication-Results-Original: spf=none (sender IP is ) smtp.mailfrom=Thomas.Fossati@arm.com;
x-originating-ip: [82.11.185.80]
x-ms-publictraffictype: Email
X-MS-Office365-Filtering-HT: Tenant
X-MS-Office365-Filtering-Correlation-Id: 75ad719b-fb0a-47be-adf1-08d7e9052a37
x-ms-traffictypediagnostic: AM6PR08MB3397:|AM6PR08MB3397:|AM0PR08MB3139:
x-ms-exchange-transport-forked: True
X-Microsoft-Antispam-PRVS: <AM0PR08MB313937A933785F4E6F5FF4149CD10@AM0PR08MB3139.eurprd08.prod.outlook.com>
x-checkrecipientrouted: true
nodisclaimer: true
x-ms-oob-tlc-oobclassifiers: OLM:9508;OLM:10000;
x-forefront-prvs: 0384275935
X-Forefront-Antispam-Report-Untrusted: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:AM6PR08MB4231.eurprd08.prod.outlook.com; PTR:; CAT:NONE; SFTY:; SFS:(4636009)(39860400002)(346002)(366004)(376002)(396003)(136003)(91956017)(76116006)(186003)(66946007)(53546011)(26005)(64756008)(2906002)(71200400001)(36756003)(66476007)(4326008)(66446008)(2616005)(66556008)(8676002)(86362001)(54906003)(8936002)(110136005)(6512007)(5660300002)(81156014)(6486002)(478600001)(316002)(6506007)(33656002); DIR:OUT; SFP:1101;
received-spf: None (protection.outlook.com: arm.com does not designate permitted sender hosts)
X-MS-Exchange-SenderADCheck: 1
X-Microsoft-Antispam-Untrusted: BCL:0;
X-Microsoft-Antispam-Message-Info-Original: NmEaSBuYwrCEA7IFWmL+qTxAUQfvksabcXfPluNx95dju0Nm0MXangA+0UOTYMtLZXTff+9yNyKhsooe0VO0cv2A0z8edVJSeb4L9M6jIhsBK5qwshACauhsKN/FSMfT3fYXR9lB/tXp2xVd6xDljfpeXFLi380r8cb2+Tm2QBLPHks360XEpQh7CkwlvDHLJPSiGIwnA/cCbOe57IYtnqs+9Bs6JqWXKb3oiP4s+VL6j++FIVXf9wbRIHwQt7XbPFyGi62M2tX63WqgIWqQaO8kfBfAExr6HPNOltVsC5wweNm8qNG0KYNR7T7P7fzj+lQMr4iX7gbaxGdUbcR/zQYh6cx9kQpnc8fzDBbQ3lfFdhoVWYlczsuWw5mlZDhVSxDoOFyIb7WrI6jL9RyEYdf8UiDLuRdaVS35t6+4bjb3aKs83lI9Dwy0cIdlri7c
x-ms-exchange-antispam-messagedata: 9FhWgA6bK0SxvIdjlJGMsIdwu35fkwsWgo0fkYbDLnG7NLsTh7JOfuRdyY00J0PNR/T3MWo2cP1ehYVtzx3ns28ra5jsS7DmOA2SN5fKrbr19n6R84tz5RNDUJbXmS2z/L68oG4oXiOGAxgZxHvkDxGhw/L6apuSCbhtv3MA0YiNTCWs/QRl5kmn07GylQKIJjLORjlftLfL6MG2DCcdvYQl//SVpX1ib29UZr3ZXtRRKY0TEjFDV8bLOKtly98pxykXffL3a8qocbYDJVhgwTO5e/aWkE0HtFqluaKcgn0LS7VxSb6dBoPp5raZLz7qj4vXgrFmIL+mVvVdhrGZigEwAQ1/5zsjaHaemaeobeMZGzyZebr4szstev1WOQyQbOIFQrLdtFZ2oJwLzUQN88+TK/+7CU+HmlBpOs0tJqbBeuv1oNuyb58sc3a8Fvfwtrgcn72eFLAJVCkg8/m+MvHuTeUE+lod7abIbLqiuMHAdKySYxIyyub813S76Uk8wWmyq10gu6CoO+pYGc2fxj+QRq56vXkvp0iC8Qx1+WsU2GbEhV/Nos5DelvZrWvY8IsEi3dpgRCPYgWMX3WqZOkOVjwhUiCQpOikt92V0AFOSR8ICKABJE7IoTqHhtvn5x1Ef2XssS5f58nwxJyATsfQsIyHJ5A09H9z3qdNTNcjJXAq2IyfFAhdgbuDopN24N5GtbqX2LKnln9LgRa+C5pBNO5TiHY7+8O0gZOb/vsJw1/WGhVcELRUzb1EOzjoLUsqnsS633Vf0LV9+2Gev/x0Q/GAWev9K/rIdC6fYlA=
Content-Type: text/plain; charset="utf-8"
Content-ID: <C721446ACD1E234F8FB4DE0A0B1D349C@eurprd08.prod.outlook.com>
Content-Transfer-Encoding: base64
MIME-Version: 1.0
X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM6PR08MB3397
Original-Authentication-Results: spf=none (sender IP is ) smtp.mailfrom=Thomas.Fossati@arm.com;
X-EOPAttributedMessage: 0
X-MS-Exchange-Transport-CrossTenantHeadersStripped: VE1EUR03FT054.eop-EUR03.prod.protection.outlook.com
X-Forefront-Antispam-Report: CIP:63.35.35.123; CTRY:IE; LANG:en; SCL:1; SRV:; IPV:CAL; SFV:NSPM; H:64aa7808-outbound-1.mta.getcheckrecipient.com; PTR:ec2-63-35-35-123.eu-west-1.compute.amazonaws.com; CAT:NONE; SFTY:; SFS:(4636009)(376002)(396003)(346002)(136003)(39860400002)(46966005)(356005)(86362001)(316002)(478600001)(6486002)(81166007)(36906005)(82740400003)(110136005)(8676002)(47076004)(6512007)(2906002)(70586007)(8936002)(26005)(2616005)(54906003)(70206006)(82310400002)(6506007)(81156014)(53546011)(5660300002)(33656002)(186003)(336012)(4326008)(36756003); DIR:OUT; SFP:1101;
X-MS-Office365-Filtering-Correlation-Id-Prvs: 2617b05c-3e16-4737-de1e-08d7e905258f
X-Forefront-PRVS: 0384275935
X-Microsoft-Antispam: BCL:0;
X-Microsoft-Antispam-Message-Info: MQ9amETHWF3lk5IEyzEisMzmnZ///DBxlVAk2Q8gXtumq8niyKfDdRoBM9RLJ07pGJS/wTYerIKb/0eay6gEqVVSjOtbOaze9bR9XTxfFYUgUr8KH1oQNvGWHaRuureuRLTveeeZdgnnzZjsQSmtJx0bBvHnZsJ5lS8RHdTDey8ooxZ35Po18zmy9rd2SbBAaNxTkeHpEPIiEz+cS40CG0juoqyp/8eCoKHI6tu4B/ED0THmuY/enTWyF1mXHlYq01SgVPOHPBbOz88Q9FmaLxKGGi68I5jrBCkl9MFzC5LS/VkcnPxrsyCO199k1u+N8/luP9WU2qqkynRDWMjrWckG2gmq0i1VPmD7y3x/WLAokUbaMwEtfBBLsXupwrIKENUG5i9lUxghAYbm7ewQ+yuXz/jjBUHncrTZiWYABiAo8i3A2yEOrvQEQCkVmzuOHPfacLgi/1ksrBFv5f8nNQK+TTMxSlWSqEfCkwMGkiYyNFC8Vo1fE93BcW6EXfc+7iqpDEABQPSH5GnYYhoKag==
X-OriginatorOrg: arm.com
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 25 Apr 2020 10:41:08.7205 (UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: 75ad719b-fb0a-47be-adf1-08d7e9052a37
X-MS-Exchange-CrossTenant-Id: f34e5979-57d9-4aaa-ad4d-b122a662184d
X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=f34e5979-57d9-4aaa-ad4d-b122a662184d; Ip=[63.35.35.123]; Helo=[64aa7808-outbound-1.mta.getcheckrecipient.com]
X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem
X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM0PR08MB3139
Archived-At: <https://mailarchive.ietf.org/arch/msg/tls/HGCMPXVj-ZJnuLXf-vgJ9lOCc78>
Subject: Re: [TLS] Choice of Additional Data Computation
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sat, 25 Apr 2020 10:41:16 -0000

On 24/04/2020, 22:35, "Eric Rescorla" <ekr@rtfm.com> wrote:
> On Fri, Apr 24, 2020 at 2:29 PM chris - <chrispatton@gmail.com> wrote:
> > I would need to study the specs in order to provide an intelligent
> > answer here. Off the hip, it would seem to depend on how the
> > boundaries between record headers and ciphertexts are determined.
> > Taking a quick look at draft-37, Fig. 4: the "full" header includes
> > three values that are excluded from the "minimal" header, the length
> > of the ciphertext being one of the fields. Presumably, when using
> > the "minimal" header, the length is a parameter that the sender and
> > receiver already agree on.
>
> Yes. It's "the rest of the UDP datagram".

I might be missing something but this doesn't look to me like the
definition of "agreed upon" by the TLS principals: an attacker can
modify what "the rest of the datagram" is at will, no?



IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.

v2.26.15 | Report a Bug | By Email | System Status