Re: [TLS] Unifying tickets and sessions

[Richard Fussenegger <[e-mail]>]

On 10/23/2014 5:56 AM, Martin Thomson wrote:
> On 22 October 2014 16:10, Richard Fussenegger <[e-mail]> wrote:
>> MUST
> The only concern here is your insistence on the use of that word,
> particularly in the captilized form.

Not insisting, you're the first to raise concerns in this regard and we 
should of course discuss that if it's the problem with the proposal.

> ...and RFC 5077 pretty much says that (and more).

Yes, but the result of these recommendations is that implementations are 
always using AES-128-CBC and ignoring any supported ciphers (that's the 
concern here at hand).

> But your requirement remains completely unverifiable and therefore
> unenforceable.

What exactly is unverifiable?

> “[…] the ticket key might be weaker than the cipher used for the 
> connection. For example, OpenSSL uses 128-bit AES keys for this purpose.”
> —Ivan Ristić: “Bulletproof SSL and TLS”, p. 58, online: 
> https://www.feistyduck.com/books/bulletproof-ssl-and-tls/

> “128 bit of security is all you get (at best), regardless of the 
> cipher which has been negociated” [sic!]
> —Florent Daigniere: “TLS “Secrets””, p. 8, online: 
> https://media.blackhat.com/us-13/US-13-Daigniere-TLS-Secrets-WP.pdf

> “The encryption of the SessionTicket depends on 128-bit AES with the 
> IV field.”
> —Joey Dreijer and Sean Rijs: “Perfect forward not so secrecy”, p. 6, 
> online: 
> https://os3.nl/_media/2013-2014/courses/ssn/projects/perfect_forward_not_so_secrecy_report.pdf

Richard