Re: [TLS] WGLC: draft-ietf-tls-session-hash

Hi.

I hadn’t read this before, so these issues may have been discussed before. Sorry if I’m wasting time like this.

The following paragraph from the Introduction is weird:

   Similar scenarios can be achieved when the handshake uses a DHE
   ciphersuite, or an ECDHE ciphersuite with an arbitrary explicit
   curve.  Even if the client or server does not prefer using RSA or
   DHE, the attacker can force them to use it by offering only RSA or
   DHE in its hello messages.  Other key exchanges may also be
   vulnerable.

The first sentence says that (EC)DHE ciphersuites are also vulnerable with explicit params. The last sentence talks of "other key exchanges", which in practice means DHE or ECDHE with named groups or curves. But that lower case “may” is content-free. Suppose a new server supports only ECDHE ciphersuites with named curves (there are some popular web sites that do this today), does it also need the session hash extension? This is not covered in either the introduction or the security considerations.

Second issue: The draft does not say whether a server should include the extension in a resumed session. The extension has no effect (as section 5.1 says), but it should be specified one way or the other. I would go for the less meaningless bytes option.

Third issue: Why can’t an attacker disable this protection by simply omitting the extension from both its ClientHello and ServerHello?  At least in the short term it won’t be practical to fail a handshake because the other side doesn’t support this extension. I guess the answer is that the ruse will work, but the other attacks mentioned in TRIPLE-HS will fail, but it’s not clear to me why. A can still proxy unchanged records from C to S if the connections are resumptions. Perhaps servers should be prohibited from resuming a session set up without this extension if the ClientHello does include the extension.

Yoav

> On Nov 23, 2014, at 9:49 PM, Sean Turner <TurnerS@ieca.com> wrote:
> 
> This is the working group last call for http://datatracker.ietf.org/doc/draft-ietf-tls-session-hash/.  Please review the document and send your comments to the list by Friday, December 12, 2014.  
> 
> Thanks,
> J&S
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls