Re: [TLS] Rethink TLS 1.3

[Florian Weimer <[e-mail]>]

On 11/24/2014 11:59 AM, Nico Williams wrote:
> On Mon, Nov 24, 2014 at 11:53:17AM +0100, Henrick Hellström wrote:
>> Yes, but the point I am trying to make, is that if the implied goal
>> is to make TLS resilient even against BEAST/CRIME style attacks, the
>> threat model should be defined accordingly. It makes little sense to
>> ask for cryptographic review of the protocol, if it is inherently
>> unclear exactly what kind of threats the protocol is designed to
>> withstand.
>
> BEAST/CRIME are dramatic demonstrations of the capabilities of attackers
> in the Internet threat model.

I really doubt that when people talked about the Internet threat model 
ten, fifteen years ago, they had adaptive chosen plaintext attacks in 
mind.  For example, they are not discussed in 
<http://tools.ietf.org/html/draft-rescorla-sec-cons-05> (as far as I can 
tell).  If such attacks are covered by the Internet threat model today, 
the model has evolved considerably.

-- 
Florian Weimer / Red Hat Product Security