IETF Logo Mail Archive

Re: [TLS] Security review of TLS1.3 0-RTT

Andrei Popov <Andrei.Popov@microsoft.com> Thu, 04 May 2017 19:03 UTC

Return-Path: <Andrei.Popov@microsoft.com>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D8289129516 for <tls@ietfa.amsl.com>; Thu, 4 May 2017 12:03:16 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.021
X-Spam-Level:
X-Spam-Status: No, score=-2.021 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id rklGg-aJGaoU for <tls@ietfa.amsl.com>; Thu, 4 May 2017 12:03:15 -0700 (PDT)
Received: from NAM02-SN1-obe.outbound.protection.outlook.com (mail-sn1nam02on0136.outbound.protection.outlook.com [104.47.36.136]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6E1FF128D69 for <tls@ietf.org>; Thu, 4 May 2017 12:03:13 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=KIKBZ2G3EzmiK3XsRtLNrMji3gOHbjgAJXsEwXwEhFM=; b=H5PqL4etTPDqQ22ZW8lY3u+dncqyqLmBaIQuk8XFQf01TUjbjAaYKtRhJ0YRFUIrc8bbhyUn22/30MGYK0EUyp7pX86dRz/YFlz+ZDernnlbmMxrfsOktNePxa899LzQ3IxzXdPI5On5IVLFUUvQddI2v1lgqUEXE43hxvvFP5M=
Received: from DM2PR21MB0091.namprd21.prod.outlook.com (10.161.141.14) by DM2PR21MB0091.namprd21.prod.outlook.com (10.161.141.14) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1084.4; Thu, 4 May 2017 19:03:11 +0000
Received: from DM2PR21MB0091.namprd21.prod.outlook.com ([10.161.141.14]) by DM2PR21MB0091.namprd21.prod.outlook.com ([10.161.141.14]) with mapi id 15.01.1084.001; Thu, 4 May 2017 19:03:11 +0000
From: Andrei Popov <Andrei.Popov@microsoft.com>
To: Colm MacCárthaigh <colm@allcosts.net>
CC: Ilari Liusvaara <ilariliusvaara@welho.com>, "tls@ietf.org" <tls@ietf.org>
Thread-Topic: [TLS] Security review of TLS1.3 0-RTT
Thread-Index: AQHSw1NLuoeRqJY1j061PhdwGwZhyaHj7JsAgAB3F+CAABcKAIAABEKggAACPYCAAAAt4IAAAZoAgAAGKVA=
Date: Thu, 04 May 2017 19:03:11 +0000
Message-ID: <DM2PR21MB0091A1AAF51428FBF96CECBD8CEA0@DM2PR21MB0091.namprd21.prod.outlook.com>
References: <CAAF6GDcKZj9F-eKAeVj0Uw4aX_EgQ4DuJczL4=fsaFyG9Yjcgw@mail.gmail.com> <20170504093429.GA31781@LK-Perkele-V2.elisa-laajakaista.fi> <DM2PR21MB0091595CE3B5D3B8EE7D3EFC8CEA0@DM2PR21MB0091.namprd21.prod.outlook.com> <CAAF6GDcEVvyRpHg4HsOo+mGysSjo1rePSByEkR6=8Bbfe2dK9g@mail.gmail.com> <DM2PR21MB00917F892A1331090F3EC6E78CEA0@DM2PR21MB0091.namprd21.prod.outlook.com> <CAAF6GDcHJC6ROe4Y3sCUzXJoERn3eC8_wmS10Zz2hBXRbmUTqg@mail.gmail.com> <DM2PR21MB0091C3CCC015ABFE1904EF008CEA0@DM2PR21MB0091.namprd21.prod.outlook.com> <CAAF6GDdh3_=N5=xSMiKxVzp0UzCm_vh6d_ZyC7ZfsDD651=_YQ@mail.gmail.com>
In-Reply-To: <CAAF6GDdh3_=N5=xSMiKxVzp0UzCm_vh6d_ZyC7ZfsDD651=_YQ@mail.gmail.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
authentication-results: allcosts.net; dkim=none (message not signed) header.d=none; allcosts.net; dmarc=none action=none header.from=microsoft.com;
x-originating-ip: [2001:4898:80e8:6::4ca]
x-ms-publictraffictype: Email
x-microsoft-exchange-diagnostics: 1; DM2PR21MB0091; 7:UnhgywGVvhWbbc6roXkZxgYTqmEVm+zV1GJgh06Llgw4M/h4Ns3E19MjU9GPLKPttCv1y7peKIXw0ELQWTHVD3T1Wt94B4Jt3SYbXyL9wCFPgM5gqKwZRwpSq9J+vvRiRu7R+WhPPUrgy+EBWlKo1yYyADzs/iCZL74eiGi/XR/3nH55TnT3YfCXKGJ5XHFhD28RkkGh7lDsDd9W1qkJgE9d2dUy8q8v9R+sOxyRwU55Q65aEDOvKRLtHgE1mR49lLTMTkxfLZwAMJ41rnhRveefZm5UE1Za32Bto8MJXtBIlUdL7ci1hfTmiSZeTnvLKLIKSisx75P5PGDGzdmpwCLfKyFmABtpcr6FxP+mCmM=
x-ms-office365-filtering-correlation-id: c61905b0-8dc5-44db-e0f0-08d4932035f1
x-ms-office365-filtering-ht: Tenant
x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001)(2017030254075)(48565401081)(201703131423075)(201703031133081); SRVR:DM2PR21MB0091;
x-microsoft-antispam-prvs: <DM2PR21MB009122C9F595C9005C73DC808CEA0@DM2PR21MB0091.namprd21.prod.outlook.com>
x-exchange-antispam-report-test: UriScan:(192374486261705)(21748063052155);
x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(61425038)(6040450)(601004)(2401047)(8121501046)(5005006)(93006095)(93001095)(3002001)(10201501046)(6055026)(61426038)(61427038)(6041248)(20161123558100)(201703131423075)(201702281528075)(201703061421075)(201703061406153)(20161123562025)(20161123560025)(20161123555025)(20161123564025)(6072148); SRVR:DM2PR21MB0091; BCL:0; PCL:0; RULEID:; SRVR:DM2PR21MB0091;
x-forefront-prvs: 02973C87BC
x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(39450400003)(39840400002)(39860400002)(39410400002)(39400400002)(39850400002)(24454002)(377454003)(6506006)(77096006)(6306002)(54896002)(6436002)(7736002)(55016002)(54906002)(8676002)(81166006)(99286003)(74316002)(3280700002)(122556002)(8936002)(189998001)(53936002)(93886004)(7110500001)(110136004)(19609705001)(229853002)(3660700001)(9686003)(4326008)(38730400002)(2900100001)(236005)(53546009)(25786009)(15650500001)(2420400007)(86362001)(33656002)(76176999)(50986999)(54356999)(7696004)(86612001)(5660300001)(478600001)(2906002)(10290500003)(10710500007)(6916009)(2950100002)(790700001)(102836003)(10090500001)(5005710100001)(6116002); DIR:OUT; SFP:1102; SCL:1; SRVR:DM2PR21MB0091; H:DM2PR21MB0091.namprd21.prod.outlook.com; FPR:; SPF:None; MLV:sfv; LANG:en;
spamdiagnosticoutput: 1:99
spamdiagnosticmetadata: NSPM
Content-Type: multipart/alternative; boundary="_000_DM2PR21MB0091A1AAF51428FBF96CECBD8CEA0DM2PR21MB0091namp_"
MIME-Version: 1.0
X-OriginatorOrg: microsoft.com
X-MS-Exchange-CrossTenant-originalarrivaltime: 04 May 2017 19:03:11.7381 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM2PR21MB0091
Archived-At: <https://mailarchive.ietf.org/arch/msg/tls/PAJSaEDxYqSN8Ya0f4jjMG_x1I4>
Subject: Re: [TLS] Security review of TLS1.3 0-RTT
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 04 May 2017 19:03:17 -0000

Indeed, as long as the scope of the ticket <= scope of the nonce database, it appears that rerouting wont’ help the attacker.
From: Colm MacCárthaigh [mailto:colm@allcosts.net]
Sent: Thursday, May 4, 2017 11:33 AM
To: Andrei Popov <Andrei.Popov@microsoft.com>
Cc: Ilari Liusvaara <ilariliusvaara@welho.com>; tls@ietf.org
Subject: Re: [TLS] Security review of TLS1.3 0-RTT

On Thu, May 4, 2017 at 11:29 AM, Andrei Popov <Andrei.Popov@microsoft.com<mailto:Andrei.Popov@microsoft.com>> wrote:

  *   Providers already work hard to maximize user affinity to a data center for other operational reasons; re-routing is relatively rare and quickly repaired by issuing a new ticket.
Understood, but isn’t an attacker going to be able to re-route at will?

Yes, but I don't see the significance.  If the attacker reroutes the user, or replays a ticket, to a different data center - the ticket won't work, it'll degrade gracefully to a regular connection.  Of course the attacker succeeded in slowing the user down, but that's possible anyway.

Maybe you're thinking of a strike register that shares a global namespace? That would be an implementation error; tickets should be scoped to the location they are issued from, and checked against its strike register (or not used at all).

--
Colm

v2.23.0 | Report a Bug | By Email