Re: [TLS] Key Control Vulnerability in SRP (Triple Handshake Variant)

Trevor Perrin <trevp@trevp.net> Fri, 08 August 2014 20:55 UTC

MIME-Version: 1.0
In-Reply-To: <DB3BE984-3839-4681-97B2-C874C5154DC1@inria.fr>
References: <79E82046-616E-4179-8CF6-12126DDE4640@inria.fr> <DB3BE984-3839-4681-97B2-C874C5154DC1@inria.fr>
Date: Fri, 08 Aug 2014 13:55:44 -0700
Message-ID: <CAGZ8ZG3=xE5xv1oVAaL1Yxc-sm4ZuA+N++E5xt_QrMLYqR+Edw@mail.gmail.com>
From: Trevor Perrin <trevp@trevp.net>
To: Karthikeyan Bhargavan <karthikeyan.bhargavan@inria.fr>
Content-Type: text/plain; charset="UTF-8"
Archived-At: http://mailarchive.ietf.org/arch/msg/tls/M0MfXNyCvFKsXb7jchqOn_9PhXo
Cc: "TLS@ietf.org (tls@ietf.org)" <tls@ietf.org>
Subject: Re: [TLS] Key Control Vulnerability in SRP (Triple Handshake Variant)
Precedence: list

On Fri, Aug 8, 2014 at 1:01 PM, Karthikeyan Bhargavan
<karthikeyan.bhargavan@inria.fr> wrote:
> Hi,
>
> The following is specific to SRP, but perhaps of interest to those working
> with TLS-SRP.
[...]
>
> While investigating the triple handshake attack on various TLS cipher
> suites, we came upon two scenarios in which one of the participants of the
> SRP protocol can unilaterally control the generated session key.

Hi Karthikeyan,

Thanks for the observation.

I haven't followed the triple-handshake discussion closely.  My
impression is that it's a TLS issue - not an SRP issue - which should
be fixed by something like [1].

Is that correct?

Trevor

[1] http://datatracker.ietf.org/doc/draft-bhargavan-tls-session-hash/

[TLS] Key Control Vulnerability in SRP (Triple Ha… Karthikeyan Bhargavan
Re: [TLS] Key Control Vulnerability in SRP (Tripl… Trevor Perrin
Re: [TLS] Key Control Vulnerability in SRP (Tripl… Karthikeyan Bhargavan
Re: [TLS] Key Control Vulnerability in SRP (Tripl… Trevor Perrin