Re: [TLS] Heartbeat and padding

On Sat, Apr 26, 2014 at 5:27 PM, Michael D'Errico <mike-list@pobox.com> wrote:
> Not related to Heartbleed(tm), do we need to revisit the Heartbeat spec.
> due to the random padding?  There is a requirement to add at least 16
> bytes of random padding to every message:
>
>    struct {
>       HeartbeatMessageType type;
>       uint16 payload_length;
>       opaque payload[HeartbeatMessage.payload_length];
>       opaque padding[padding_length];
>    } HeartbeatMessage;
>
>    ...
>
>    padding:  The padding is random content that MUST be ignored by the
>       receiver.  The length of a HeartbeatMessage is TLSPlaintext.length
>       for TLS and DTLSPlaintext.length for DTLS.  Furthermore, the
>       length of the type field is 1 byte, and the length of the
>       payload_length is 2.  Therefore, the padding_length is
>       TLSPlaintext.length - payload_length - 3 for TLS and
>       DTLSPlaintext.length - payload_length - 3 for DTLS.  The
>       padding_length MUST be at least 16.
>
>    The sender of a HeartbeatMessage MUST use a random padding of at
>    least 16 bytes.  The padding of a received HeartbeatMessage message
>    MUST be ignored.
>
>
> Since the recipient MUST ignore the padding, they can't reverse engineer
> the peer's PRNG, so maybe this isn't a problem?

Two points: Your PRNG shouldn't allow state recovery given a sample,
and if telling people to ignore things that they shouldn't look at
worked, we wouldn't need TLS. That said we need to do some serious
removal of unused options.

Sincerely,
Watson Ladd
>
> Mike
>
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls