IETF Logo Mail Archive

Re: [TLS] Security review of TLS1.3 0-RTT

Benjamin Kaduk <bkaduk@akamai.com> Tue, 02 May 2017 19:31 UTC

Return-Path: <bkaduk@akamai.com>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B33B0126C3D for <tls@ietfa.amsl.com>; Tue, 2 May 2017 12:31:30 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -0.001
X-Spam-Level:
X-Spam-Status: No, score=-0.001 tagged_above=-999 required=5 tests=[BAYES_50=0.8, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=akamai.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gjLSww6l6eNs for <tls@ietfa.amsl.com>; Tue, 2 May 2017 12:31:29 -0700 (PDT)
Received: from prod-mail-xrelay05.akamai.com (prod-mail-xrelay05.akamai.com [23.79.238.179]) by ietfa.amsl.com (Postfix) with ESMTP id BC11612946D for <tls@ietf.org>; Tue, 2 May 2017 12:28:38 -0700 (PDT)
Received: from prod-mail-xrelay05.akamai.com (localhost.localdomain [127.0.0.1]) by postfix.imss70 (Postfix) with ESMTP id 425794334BC; Tue, 2 May 2017 19:28:38 +0000 (GMT)
Received: from prod-mail-relay10.akamai.com (prod-mail-relay10.akamai.com [172.27.118.251]) by prod-mail-xrelay05.akamai.com (Postfix) with ESMTP id 2C210433407; Tue, 2 May 2017 19:28:38 +0000 (GMT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=akamai.com; s=a1; t=1493753318; bh=UpZ6JlMgIVNRWUFB5zbiDZJAihDGBgxXD4cXNtah5kg=; l=2225; h=To:References:Cc:From:Date:In-Reply-To:From; b=N2XTsAMWmm6em4TIXS7IlHxKTOt2p3w0TRPctLWYrv+fe6B7YTNadWcI4Xo9/Xa9H 9eMpEjP8C4J6Yz7iwv+NORz4lVUlTro2+nY13spyYiZVaZY7MOJjffrXGierbmpv5i q4rRpvn3/DyaTzWvKzWoXulPkoccl560BEkMWEnY=
Received: from [172.19.17.86] (bos-lpczi.kendall.corp.akamai.com [172.19.17.86]) by prod-mail-relay10.akamai.com (Postfix) with ESMTP id DB6541FD06; Tue, 2 May 2017 19:28:37 +0000 (GMT)
To: Nico Williams <nico@cryptonector.com>
References: <CAAF6GDcKZj9F-eKAeVj0Uw4aX_EgQ4DuJczL4=fsaFyG9Yjcgw@mail.gmail.com> <C29356B3-6D71-4088-9AB3-4954327F1E7B@dukhovni.org> <20170502173905.GC10188@localhost> <CAAF6GDeYc5o=eeeyV6HhK9vrLngB-Y=Ed5BdedrE8h2-py4oAw@mail.gmail.com> <20170502180049.GE10188@localhost> <CAAF6GDecd=x-Ob_eO1vSWr6cb6jAeyHBx7zf6cpX=GfxBosfLQ@mail.gmail.com> <20170502182529.GG10188@localhost> <466fad64-5acd-d888-1574-10f95b2ab7bc@akamai.com> <20170502192003.GH10188@localhost>
Cc: Colm MacCárthaigh <colm@allcosts.net>, TLS WG <tls@ietf.org>
From: Benjamin Kaduk <bkaduk@akamai.com>
Message-ID: <e313032d-2ac8-cc4e-0aa7-de869007e397@akamai.com>
Date: Tue, 02 May 2017 14:28:37 -0500
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.8.0
MIME-Version: 1.0
In-Reply-To: <20170502192003.GH10188@localhost>
Content-Type: multipart/alternative; boundary="------------BA97AD01801BE5FBAEFF73E2"
Archived-At: <https://mailarchive.ietf.org/arch/msg/tls/JDYCvnFwp0ijF_iROLVjnvz9TTU>
Subject: Re: [TLS] Security review of TLS1.3 0-RTT
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 02 May 2017 19:31:31 -0000

On 05/02/2017 02:20 PM, Nico Williams wrote:
> On Tue, May 02, 2017 at 02:17:17PM -0500, Benjamin Kaduk wrote:
>> [ stuff about 1.2 elided ]
> OK, sure, but why not avoid the problem in the first place in 1.3 by
> sending an encrypted timestamp authenticator (sound familiar?).
>

If you mean an actual timestamp, see my previous reply about clock accuracy.

If you mean an encrypted relative time, well, that's what it is.  The
encryption is incredibly ad hoc, and requires that the key only be used
once, but the whole thing started by thinking of it as a super-janky
encryption scheme.  See
https://www.ietf.org/mail-archive/web/tls/current/msg20373.html and nearby.

-Ben

v2.23.0 | Report a Bug | By Email