Re: [TLS] TLS ECH, how much can the hint stick out?

Mike Bishop <mbishop@evequefou.be> Thu, 10 September 2020 21:21 UTC

Return-Path: <mbishop@evequefou.be>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5CADD3A08B6 for <tls@ietfa.amsl.com>; Thu, 10 Sep 2020 14:21:22 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.9
X-Spam-Level:
X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=evequefou.onmicrosoft.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id sEve65T7kjWa for <tls@ietfa.amsl.com>; Thu, 10 Sep 2020 14:21:20 -0700 (PDT)
Received: from NAM11-BN8-obe.outbound.protection.outlook.com (mail-bn8nam11on2129.outbound.protection.outlook.com [40.107.236.129]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5D54D3A0843 for <tls@ietf.org>; Thu, 10 Sep 2020 14:21:20 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=W83IwRb51Muaoj1pbLfPaP0SYnAOp80PlyZlVzJ5/cQc+vaCDTrn1cvbpqIouXd3LarXeqIbxDloawYSdw9iNeiM75S21Yu8RS9+DyefqfH7rrlfN8SZGpMlHZot/WrrexmfYAf3ckIQaWWSgVOtxuF4S3hZ+XhJRz1inHUNKBk/Xvx/T6TCD5NUHdRUY/uuVW5G/vICB3VkzBLvavI02U//7ObGWOgZUIib/1mc7sbPd1seWEwd5Tlul4dZso/deSehG73Tf2/KIZKXWTzvB5ocsvNgfRw08xihDvuVsXSyIhtND0cJ9rVpRmyoERWRC3EzVe8XgH7qpbFYKunjBQ==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=Ad7SO+x/9YqPfwyl2IcNojK3Nceqv3MCaCJ+qGgxxHY=; b=I32c+n2RAY4W4v1iCLif6n8Nw5HF3tTka5rxALj6rpddpOoaOVRM/pF+ga3vE3+GUf8fWi5NP/XPy7RDuYGruUpxy+86iAYgsgfBnI1qeYJeii03KtL6sgeSsIFBNMVtBbVUVARzlLRDzi/sKtdJ8tpka608RUrobosRsl3gYoL3QuFz0nDHqA/JymJ+nwXpJM9lJMaT9yfKb15bt22IkSgGMX0zR56wxHccOs4YeKi/FelUPMFTBv7SMyNUmVxDeNR0CObkle532sD5hYt9MYOWKlYch6TwioV4WjTwTFVcTx2/6uPrHa0VVIxaUTXRSaD2Zkdx10GyhMMTdYhmiA==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=evequefou.be; dmarc=pass action=none header.from=evequefou.be; dkim=pass header.d=evequefou.be; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=evequefou.onmicrosoft.com; s=selector2-evequefou-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=Ad7SO+x/9YqPfwyl2IcNojK3Nceqv3MCaCJ+qGgxxHY=; b=WMzxaROw4PHuBXnDFXl7S60jWSklssRXiHK2K+/aSc+vF0kNaHyJTw2SKE2wJnWhXXjfEbv338CWvTSFvvLWglYtUfXPbWae1QHXAdODM1J99nrIitJjFy4QassDvu5PAUrItuttV6jpTy06AxB6fplzay22KbI65WMG2Xuoup8=
Received: from CH2PR22MB2086.namprd22.prod.outlook.com (2603:10b6:610:8c::8) by CH2PR22MB1894.namprd22.prod.outlook.com (2603:10b6:610:8f::7) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3370.16; Thu, 10 Sep 2020 21:21:17 +0000
Received: from CH2PR22MB2086.namprd22.prod.outlook.com ([fe80::2827:5a3c:11db:7a55]) by CH2PR22MB2086.namprd22.prod.outlook.com ([fe80::2827:5a3c:11db:7a55%4]) with mapi id 15.20.3370.016; Thu, 10 Sep 2020 21:21:17 +0000
From: Mike Bishop <mbishop@evequefou.be>
To: Eric Rescorla <ekr@rtfm.com>
CC: Christopher Patton <cpatton=40cloudflare.com@dmarc.ietf.org>, Christian Huitema <huitema@huitema.net>, "tls@ietf.org" <tls@ietf.org>
Thread-Topic: [TLS] TLS ECH, how much can the hint stick out?
Thread-Index: AQHWhfPKZCd76N1m6EGBOv8Plhva3qlfDioAgAMq5hCAABRJgIAADuSg
Date: Thu, 10 Sep 2020 21:21:16 +0000
Message-ID: <CH2PR22MB20863DBD4E21E059CF9EFCCFDA270@CH2PR22MB2086.namprd22.prod.outlook.com>
References: <d33c685c-6bf3-1584-4d95-1fe2cf6695e8@huitema.net> <CAG2Zi23NQRPUzHbVKSSSxR_eaNokVF--K9FfCNMagrCKnSHMZQ@mail.gmail.com> <CH2PR22MB2086C4A5232D3605F66D4F1ADA270@CH2PR22MB2086.namprd22.prod.outlook.com> <CABcZeBPx1DrKC_vCL-n4GUEbi0hLZ-PREhgJaog+Bkata3v14w@mail.gmail.com>
In-Reply-To: <CABcZeBPx1DrKC_vCL-n4GUEbi0hLZ-PREhgJaog+Bkata3v14w@mail.gmail.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: yes
X-MS-TNEF-Correlator:
authentication-results: rtfm.com; dkim=none (message not signed) header.d=none;rtfm.com; dmarc=none action=none header.from=evequefou.be;
x-originating-ip: [72.49.212.17]
x-ms-publictraffictype: Email
x-ms-office365-filtering-correlation-id: a5187371-3c19-4692-34f8-08d855cf7488
x-ms-traffictypediagnostic: CH2PR22MB1894:
x-microsoft-antispam-prvs: <CH2PR22MB1894DB0E5214BC667C1D691CDA270@CH2PR22MB1894.namprd22.prod.outlook.com>
x-ms-oob-tlc-oobclassifiers: OLM:9508;
x-ms-exchange-senderadcheck: 1
x-microsoft-antispam: BCL:0;
x-microsoft-antispam-message-info: 6XC4N92VVvrCGR4qLNOwOhh3OXQTlMrBJ5q6/As7PnYOGYHGYCgy9PFw1Bj91oR+qdWUohyy2sUcztRBwG1txEloOVrebzwcuMUtuUiSk5JaGBwCsKwwt3pBmhZkPeV8VaSO2gmB1e9GA7ToGLatb0dYG8a+ymW+nZ7cVsJhCwYXZKeLdo465oDMZJPVUZXIR7tTOabGGM48lPYXqTmZhPT49OHULV+DCZ1E8T1hqwEJyGLhGc2pHtxNnRPny1Yd4jBFgUlrIwLzA/FmPoNyDXiesqODZU+vIjgtW1phiIyx2ZXf0uhRO8M7ZrwFtOQnbpnpl+zdI39MTeJhOFVgncaGhyhkP5wRQmc92uppzrQD9qXxROOpr7wtiNeE0wEZSHXS+y/DWwVIJBR1ADfH8Q==
x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:CH2PR22MB2086.namprd22.prod.outlook.com; PTR:; CAT:NONE; SFS:(376002)(39830400003)(366004)(346002)(136003)(396003)(33656002)(6506007)(478600001)(99936003)(66946007)(54906003)(26005)(6916009)(83380400001)(64756008)(66556008)(66616009)(166002)(76116006)(66446008)(86362001)(66476007)(5660300002)(52536014)(8936002)(186003)(55016002)(966005)(4326008)(316002)(9686003)(2906002)(8676002)(53546011)(71200400001)(7696005); DIR:OUT; SFP:1102;
x-ms-exchange-antispam-messagedata: J3GII62pB2y60p1RNyTTnPauMtk8SImoGNhDfCeypOl96/Jl7Oa4ddnTNBafHP2I7FCem8pTsdcZNDYnv29K6gAgQ5sIYbIzyhS5XQ+l3LWjFto8ihFT8E1gZHj/feU9gt2tSqCyjLcsN+b/aNgoxjkXSl8AWMMiuvNbcOSN+jpxpwk0ddPcl5Zl2Fr223/KFh8OseXE9n1p3S18mg3BAZ77BSrbZ2cHhLOVD2OcXGeZqogeJu2mUigrzF8NbYb52aYaKYZqaATRxJlHJf2XQYKWjD5rgKCpn5sJWYez82hwPGWGtraqb84ejvfPrpt2Z0VXph3AvRST7a2CyIQxAhZZnLfqOoDJ+jCxicLz4IKPQeMtRLATAs4wuUOkToXQ3ZClXW5jH22WOWWg61FMKmTBieUVIvYatesONE7OktU3plWCa+rvJRfks29T6lpCiy+aSNYaoJkSRmeUmXzWkUDmD2cO0Svfd9M+Zi6v34XBjOxR2Wv5wDO4URiNl7+XYhso1fzo+K5ORujC1XAdlcmt7UoBvqQvd2i3CDTlwi2USeLj3+ly1HlBXWtZjUz5qbmEMAavBiwrcj2BQ5aJPqaX1akgyVf9UrQcxi9m1IE1IukQOfFxEkTibHhXyDdnjbfAZU1DhNMEZ47svKjDGg==
x-ms-exchange-transport-forked: True
Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg="2.16.840.1.101.3.4.2.1"; boundary="----=_NextPart_000_013C_01D68796.C93B7710"
MIME-Version: 1.0
X-OriginatorOrg: evequefou.be
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: CH2PR22MB2086.namprd22.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: a5187371-3c19-4692-34f8-08d855cf7488
X-MS-Exchange-CrossTenant-originalarrivaltime: 10 Sep 2020 21:21:17.2897 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 41eaf50b-882d-47eb-8c4c-0b5b76a9da8f
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: 8lojVwxNtMi794eK9anS+175Y7zlxDE3m6sGfWTNF/9OmUC9qyo/1H+cYYqE5//RKRuMELiH4Bc3VVHquFO9nA==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH2PR22MB1894
Archived-At: <https://mailarchive.ietf.org/arch/msg/tls/hib9e_1E3kdP5z0Uovo_FpBXVTg>
Subject: Re: [TLS] TLS ECH, how much can the hint stick out?
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 10 Sep 2020 21:21:23 -0000

Certainly it’s better for the server if it can be consistent, especially if it expects multi-packet first flights.  If the same back-end sees both, it can discard the second, and that’s what I’d expect most of the time.  But here’s what I think is possible:

 

The client sends an Initial packet (randomly selected Destination CID), PTOs, then sends another Initial packet to the same Destination CID.  On the server side, the infrastructure assumes that Initial packets whose CIDs aren’t issued by them can be routed to a random back-end, and that back-end will set a new DCID that routes to it in the future.

 

The client will receive either of the Server Initial packets, switch to the new DCID, and will reject the other because attempts to change the server’s CID a second time.  The connection succeeds because whichever server’s ServerHello is used also has its DCID used, so all subsequent packets go to that back-end.

 

From: Eric Rescorla <ekr@rtfm.com> 
Sent: Thursday, September 10, 2020 3:58 PM
To: Mike Bishop <mbishop@evequefou.be>
Cc: Christopher Patton <cpatton=40cloudflare.com@dmarc.ietf.org>; Christian Huitema <huitema@huitema.net>; tls@ietf.org
Subject: Re: [TLS] TLS ECH, how much can the hint stick out?

 

 

 

On Thu, Sep 10, 2020 at 11:52 AM Mike Bishop <mbishop@evequefou.be <mailto:mbishop@evequefou.be> > wrote:

This is primarily an active attack, but not purely so.  Clearly the MITM is an active attacker, but there are situations in QUIC (and DTLS, I presume) where a ClientHello gets retransmitted.  Depending on server infrastructure, the client might get two different responses.  

 

This doesn't sound correct. In this circumstance, the client and the server might have mismatched SH values and the handshake will fail. To the best of my knowledge, the server is required to behave consistently in this case, even if it consists of multiple machines.

 

-Ekr

 

 

So I think we need to decide whether it’s a goal that, given that relatively narrow situation, the observer shouldn’t be able to identify ECH acceptance by comparing two ServerHellos that both respond to the same ClientHello.

 

From: TLS <tls-bounces@ietf.org <mailto:tls-bounces@ietf.org> > On Behalf Of Christopher Patton
Sent: Tuesday, September 8, 2020 2:23 PM
To: Christian Huitema <huitema@huitema.net <mailto:huitema@huitema.net> >
Cc: tls@ietf.org <mailto:tls@ietf.org> 
Subject: Re: [TLS] TLS ECH, how much can the hint stick out?

 

Hi Christian, Hi list, 

 

The "don't stick out" property is a steganographic security goal: we want the "real" protocol, i.e. TLS with ECH acceptance, to be indistinguishable from the "cover" protocol, i.e., the handshake pattern in which the client sends a "dummy" ECH extension that is ignored or rejected by the server. This is a property that TLS was never designed to have, but it seems that we need some degree of it in order to deploy ECH. The fundamental question that Christian raises is what is the right threat model for this property.

 

The "status quo" threat model considers a distinguisher that is strictly passive---it does not interfere with a handshake or probe the server---and that does not know the ECH configuration. This seems (to me, at least) sufficient to account for middleboxes that might ossify on the ECH extension. It also seems achievable, both by the ECH as it is and for the proposed change.

 

The distinguishing attacks described by Christian are much stronger, in the sense that they involve an active attacker. I don't believe there is any way of implementing ECH---either as it is or with the proposed change---that defeats active attacks in general. In particular---and as Christian points out---an active attacker can probe the server to learn the ECH configuration (via the ECH retry logic), which it can use to easily distinguish the real protocol from the cover protocol. This works regardless of whether the change is adopted.

 

In my view, achieving don't-stick-out-security against active attackers requires us to revisit the design of ECH altogether. The main difficulty is that client-facing servers publish the ECH configuration in a way that's easily accessible to an active attacker. Keeping the configuration secret may provide a way to achieve security, and some deployments might opt to do this; but the vast majority won't. We might consider adding support for this deployment scenario, but this can (and should, I think) wait for a later draft.

 

That said, it is worth considering mitigations against known attacks, in particualr (1). I think the suggestion for mitigating (2) adds too much complexity, and if it doesn't fully address the intended threat model (I don't think it does), then we'll likely need to replace it in the future. I think it's better to keep things simple until we fully address the intended threat model.

 

Best,

Chris P.

_______________________________________________
TLS mailing list
TLS@ietf.org <mailto:TLS@ietf.org> 
https://www.ietf.org/mailman/listinfo/tls