Re: [TLS] AAED ciphers: AES-GCM vs AES-EAX/AES-CCM: a meta-analysis

[Tom Ritter <[e-mail]>]

On 26 January 2015 at 12:46, Joe Hall <[e-mail]> wrote:
> Wasn't the discussion in Denver of the flavor that applications will
> have to do length-hiding right if they want it to be secure so it
> doesn't make sense to do it in TLS? I'm probably mischaracterizing
> that, but I thought the outcome was more definitive than "maybe
> someone will get to it". (i.e., some thought it would be a bad idea to
> do it at all as it would be easy for applications to use it in an
> insecure manner)

Length hiding in the application will be able provide more nuanced and
context-dependent protection, no doubt.  But that doesn't mean
providing it as a feature in the protocol is without merit.
Application-specific protection is more robust against adaptive query
attacks whether the adversary is measuring response time.  But for
response times visible in passive captures, an application is usually
not going to leak enough timing information for a reasonable guess on
a single query.  (Think an application taking more or less time to
process a small image versus a larger image - the "proper" way to do
this is inside the application, and have it adjust it's processing
time accordingly to not leak timing information.)

Length Hiding in TLS gets you good protection against passive captures
and lets you deploy the mechanism independent of building in the
feature at Layer 7 or above in multiple applications, application
protocols, web frameworks, etc.  (Some of which may be old and
unmaintained, but still running lots of services on the Internet.)

>From my recollection at Denver:
 - Consensus was we didn't want to pay a 2-byte penalty to put padding
in everywhere by default
 - Rough Consensus was padding without paying a penalty was something
reasonable to pursue
 - A few of us (dkg, myself, Alfonso) were going to think about how to
do that and also consider writing a BCP on why padding is useful, when
it makes sense, and rough strategies for doing it

-tom