Re: [TLS] Another IRINA bug in TLS

[Karthikeyan Bhargavan <[e-mail]>]

The confusion between DSA and PKCS#3 has other unexpected consequences.
As we describe in 3.5 of our Imperfect Forward Secrecy paper, some server
implementations take a DSA group (p,q,g) and, when fitting it to TLS, confuse
the “q” with the generator “g”. This bug leads to a rather nasty attack.

(Yeah, you’d probably want to add this to the WTF category.)


On 24 May 2015, at 09:12, Peter Gutmann <[e-mail]> wrote:

> Jeffrey Walton <[e-mail]> writes:
> 
>> GnuTLS with its Lim-Lee primes causes me a lot of problems because they
>> cannot be validated.
> 
> Actually the problem isn't GnuTLS (hey, I use Lim-Lee primes as well!), it's
> the fact that TLS uses the PKCS #3 format rather than the DSA format, so
> you've got nice verifiable values for which you have to throw away the
> parameter used to verify them and send them in an unverifiable format.  Having
> said that, there's a pretty simple fix, define an extension that acts like the
> existing propose/accept extensions that signals a change in DH values to the
> DSA form (p, q, g) rather than PKCS #3 form (p, g).  And for TLS 1.3, use the
> DSA form by default, not the PKCS #3 form.
> 
> Peter.
> 
> _______________________________________________
> TLS mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/tls