Re: [TLS] I-D Action: draft-ietf-tls-chacha20-poly1305-00.txt

[Simon Josefsson <[e-mail]>]

Nikos Mavrogiannopoulos <[e-mail]> writes:

> For channel-binding using anonymous ciphersuites, is that defined 
> somewhere? If that practice is already used and defined by IETF, 
> adding an anonymous ciphersuite may make sense.

It is discussed in RFC 5802:

   If the external security layer used to protect the SCRAM exchange
   uses an anonymous key exchange, then the SCRAM channel binding
   mechanism can be used to detect a man-in-the-middle attack on the
   security layer and cause the authentication to fail as a result.
   However, the man-in-the-middle attacker will have gained sufficient
   information to mount an offline dictionary or brute-force attack.

In my view, using anonymous key exchanges with channel binding is a bad
idea.  It opens up for these attacks and there is no ways of detecting
them.  If ANON ciphersuites aren't used, there is at least a way to
detect MITM, and even if verification didn't happen directly, you can
log fingerprints for later auditing to prove what happened.

I believe more solid use-cases are needed to motivate ANON ciphersuites.
The use-cases presented so far does not strike me as fully fleshed out,
and there appears to be better ways of adressing them.

/Simon