Re: [TLS] [Technical Errata Reported] RFC5288 (4694)

[Aaron Zauner <[e-mail]>]

Hi Kenny,

> On 16 May 2016, at 16:48, Paterson, Kenny <[e-mail]> wrote:
> 
> Maybe the confusion is this: in your authenticity attack, you do recover
> the GHASH key, and the effect is catastrophic. In the confidentiality
> attack, one can recover plaintexts for the records with repeated nonces,
> but not the encryption key. The effect may be bad - but it's perhaps not
> as catastrophic in practice as the authenticity attack.

Ah, I see. Yes and we do not consider this in our paper at all. Maybe we should? Not sure how practical this is.

> Think about it this way: for your injection attack, you need to recover
> the CTR keystream - otherwise you couldn't properly AES-GCM-encrypt your
> chosen plaintext record for the injection. But if you recovered the
> keystream as part of your attack, then you've also recovered the plaintext
> for the original record.
> 
> Or maybe in your injection attack you were assuming you already *knew* the
> plaintext? That would make sense, I guess - a lot easier then to recover
> the keystream than doing the "undoing the XOR" attack needed to recover
> P_1 and P_2 from P_1 XOR P_2.

The first step of our attack involves attacker controlled content. So yes (phishing, unauthenticated HTTP, selective company DPI etc.). In our example we use a local proxy to carry out the attack. I hope I can post a full version of the actual paper and PoC to this thread soon.

Aaron