IETF Logo Mail Archive

Re: [TLS] Security review of TLS1.3 0-RTT

Viktor Dukhovni <ietf-dane@dukhovni.org> Fri, 19 May 2017 20:58 UTC

Return-Path: <ietf-dane@dukhovni.org>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 161A4129B19 for <tls@ietfa.amsl.com>; Fri, 19 May 2017 13:58:35 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.9
X-Spam-Level:
X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id EurZ0nfTMAAo for <tls@ietfa.amsl.com>; Fri, 19 May 2017 13:58:33 -0700 (PDT)
Received: from mournblade.imrryr.org (mournblade.imrryr.org [108.5.242.66]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B14381296D2 for <tls@ietf.org>; Fri, 19 May 2017 13:58:33 -0700 (PDT)
Received: from [172.31.31.193] (gzac12-mdf2-1.aoa.twosigma.com [208.77.215.155]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mournblade.imrryr.org (Postfix) with ESMTPSA id 11A587A32F1 for <tls@ietf.org>; Fri, 19 May 2017 20:58:33 +0000 (UTC) (envelope-from ietf-dane@dukhovni.org)
Content-Type: text/plain; charset="us-ascii"
Mime-Version: 1.0 (Mac OS X Mail 10.3 \(3273\))
From: Viktor Dukhovni <ietf-dane@dukhovni.org>
In-Reply-To: <CAF8qwaByGeGtap8gDB-p3n-0DMqEL9uJGJQ4EErfkq-SFcbHGQ@mail.gmail.com>
Date: Fri, 19 May 2017 16:58:32 -0400
Content-Transfer-Encoding: quoted-printable
Reply-To: TLS WG <tls@ietf.org>
Message-Id: <5513C0EF-3282-4B87-AF0B-3B07D1094B50@dukhovni.org>
References: <CAAF6GDcKZj9F-eKAeVj0Uw4aX_EgQ4DuJczL4=fsaFyG9Yjcgw@mail.gmail.com> <CABcZeBNcnW9zEPZ4mEje1_ejR3npNFz65rw-6qUPn7cQt1Nz9w@mail.gmail.com> <CAAF6GDe1_ih1aUShrzAHUuTzbLx6+0BdVexpGnq90RZsST8GvA@mail.gmail.com> <CABcZeBOX5NXuhgfap2S0naO9PFXv+K-+fZVPbgck6yciVnrYbQ@mail.gmail.com> <CABcZeBPuOupLTNKOtuCgOjYNdiuw571HM-pq1vNZz_8x-XX5mg@mail.gmail.com> <CABcZeBMqALJ10cU7FMUhv8k5Q=tw3yu1-5pdrKzOBM3=g5PHJw@mail.gmail.com> <20170519095316.GA30080@LK-Perkele-V2.elisa-laajakaista.fi> <CAAF6GDeuRMZx9MRynrxMp1fCvRS2jjr0vcqt0R89cJEkD6u=rQ@mail.gmail.com> <20170519184051.GA31741@LK-Perkele-V2.elisa-laajakaista.fi> <CAAF6GDcP3_+WOB1xsc7JecpCo2-MfeuHgkN7PVrUiLweeurv2g@mail.gmail.com> <CAF8qwaByGeGtap8gDB-p3n-0DMqEL9uJGJQ4EErfkq-SFcbHGQ@mail.gmail.com>
To: TLS WG <tls@ietf.org>
X-Mailer: Apple Mail (2.3273)
Archived-At: <https://mailarchive.ietf.org/arch/msg/tls/PmEXGG4j0uHgmy3_PAnliyCoE8c>
Subject: Re: [TLS] Security review of TLS1.3 0-RTT
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 19 May 2017 20:58:35 -0000

> On May 19, 2017, at 4:49 PM, David Benjamin <davidben@chromium.org> wrote:
> 
> Could you expand on your cryptanalysis? I don't believe this is actually leaked. It's addition mod 2^32, not XOR, which means you effectively randomize the parent starting time. (It was initially XOR, and then shortly changed to addition.) Consider:
> 
> initial connection at time t1, issues a ticket with ticket_age_add = x. Let t1' = t1 - x.
> Resumption 1 at time t2, offers t1's ticket. The attacker learns t2 - t1 + x = t2 - t1'.
> Resumption 2 (or HelloRetryRequest) at time t3, offers t1's ticket. The attacker learns t3 - t1 + x = t3 - t1'.
> 
> x is uniformly distributed over [0, 2^32), so t1' = t1 - x is as well. This is a one-time pad on t1, correctly used only once. x is only ever used to encrypt one timestamp, t1.
> 
> Of course, the attacker can correlate t2 and t3 by subtracting the two public values and checking against the public difference between connections they observe. But the ticket's already leaked anyway.

+1.  The additive obfuscation leaks nothing that is not already leaked just by sending the tickets.

-- 
	Viktor.

v2.23.0 | Report a Bug | By Email