Re: [TLS] RFC 7457, Lucky 13, mitigation, DTLS 1.2

["Paterson Kenneth" <[e-mail]>]

Hi Achim,

Let's take this off the list, as the details are probably not too interesting to many folks these days?

Cheers

Kenny

-----Original Message-----
From: Achim Kraus <[e-mail]>
Date: Monday, 9 September 2019 at 11:49
To: Paterson  Kenneth <[e-mail]>, "[e-mail]" <[e-mail]>
Subject: Re: [TLS] RFC 7457, Lucky 13, mitigation, DTLS 1.2

    Hi Kenny,
    
     > That would still leave a timing side channel which would reveal
    whether the padding length exceeds the amount of data.
    
    Maybe I was not precise:
    Regardless of the content of the padding length byte and the result of
    it's overflow check, I would always apply b), as you (and others)
    recommended in the document. My impression of that "defined padding and
    check" was a optimization to skip the MAC calculations. But as lucky13
    shows, the MAC must always be calculated and filled up with extra
    evaluations!
    But, if b) is always applied, the intensive padding check in a) should
    be possibly replaced by a simple overflow check without drawback.
    
     > I'd need to dig into it more to be certain, but my sense is that such
    a side channel could be turned into at least a partial plaintext
    recovery attack, and possibly a full plaintext recovery attack.
    
    That would be great!
    
    Just one additional question, but if it's too far/deep, just ignore it:
    My impression is, that the "plaintext recovery" requires the same
    plaintext payload "serveral" times. Then the recover is from the end,
    starting with 2 bytes, adding more bytes toward the start of the message
    (here it comes, that it must be the same plaintext). With that, I'm
    wondering, if such an approach could pass the MAC part (as plaintext
    recovery), because this seems to be changing from session to session or
    with the record sequence number. Assuming, that therefore the MAC part
    must be cut of efficiently, but leave enough for still have an MAC check
    on the truncated message, lead to a conclusion, that at least very short
    messages are not affected. Does this match your assumptions?
    
    best regards
    Achim Kraus
    
    Am 09.09.19 um 10:45 schrieb Paterson  Kenneth:
    > Hi Achim,
    >
    > See below for a comment on your analysis.
    >
    > -----Original Message-----
    > From: TLS <[e-mail]> on behalf of Achim Kraus <[e-mail]>
    > Date: Monday, 9 September 2019 at 09:24
    > To: "[e-mail]" <[e-mail]>
    > Subject: [TLS] RFC 7457, Lucky 13, mitigation, DTLS 1.2
    >
    >      RFC 7457, Lucky 13, mitigation, DTLS 1.2
    >
    >      Dear List,
    >
    >      currently I try to do some investigation about the simplest way to
    >      mitigate the “lucky 13” attack without using RFC 7366.
    >
    >      Therefore I read the slides in [1] and also the recommended mitigation
    >      in [2], which is cited in RFC 7457.
    >
    >       From the slides, my impression is, that the “defined padding & padding
    >      check” was used to reduce the “timing side channel” of MAC depending on
    >      the data fragment size. Lucky 13 demonstrates, that this “defined
    >      padding” could be tricked out.
    >
    >      The recommended mitigation in [2] describes on page 539 to do,
    >      a) the padding check “time side channel” free by using always “256 compares”
    >      b) and the MAC check “time side channel” free, by adjust the number of
    >      compression function evaluations with extra evaluations on dummy data to
    >      achieve always the same number of evaluations.
    >
    >      FMPOV b) is the one, which closes the “time side channel”.
    >      But a) seems to be more a left over. It doesn’t protect enough, as lucky
    >      13 shows, and complicated algorithms, as “always 256 compares” even on
    >      shorter messages, may harm more.
    >
    >      So, why should that “defined padding” check be done, if b) is applied?
    >
    >      Wouldn’t a simple check, if the padding length exceeds the amount of
    >      data, and on failure, set it to 0, simplify the mitigation?
    >
    > That would still leave a timing side channel which would reveal whether the padding length exceeds the amount of data. I'd need to dig into it more to be certain, but my sense is that such a side channel could be turned into at least a partial plaintext recovery attack, and possibly a full plaintext recovery attack.
    >
    > You might want to read Adam Langley's account of how L13 was addressed in OpenSSL:
    >
    > https://www.imperialviolet.org/2013/02/04/luckythirteen.html
    >
    > Regards,
    >
    > Kenny
    >