Re: [TLS] Encryption of TLS 1.3 content type

Nikos Mavrogiannopoulos <nmav@redhat.com> Mon, 28 July 2014 15:14 UTC

Message-ID: <1406560456.7750.20.camel@dhcp-2-127.brq.redhat.com>
From: Nikos Mavrogiannopoulos <nmav@redhat.com>
To: Colm MacCárthaigh <colm@allcosts.net>
Date: Mon, 28 Jul 2014 17:14:16 +0200
In-Reply-To: <CAAF6GDcKqymNMnVa50Q7kSTgHrWcM1-qMNGyxU-NcjXMnCD3gQ@mail.gmail.com>
References: <DD255E31-FA87-40CE-AF13-0F43A7DD54CF@cisco.com> <CACsn0cnt-ry182AjOyTTZGteifs7VyRPYHaj-xDCBOf0D53w9A@mail.gmail.com> <CAAF6GDfK7awipoMT_PPyKnTe-fF1=KY1Be8kUMSYrXN0Wzb=tg@mail.gmail.com> <1406537753.2413.12.camel@dhcp-2-127.brq.redhat.com> <CAAF6GDcKqymNMnVa50Q7kSTgHrWcM1-qMNGyxU-NcjXMnCD3gQ@mail.gmail.com>
Content-Type: text/plain; charset="UTF-8"
Mime-Version: 1.0
Content-Transfer-Encoding: 8bit
Archived-At: http://mailarchive.ietf.org/arch/msg/tls/QdSzODbvKCgAFfQeovZK4kGSCnU
Cc: tls@ietf.org
Subject: Re: [TLS] Encryption of TLS 1.3 content type
Precedence: list

On Mon, 2014-07-28 at 07:54 -0700, Colm MacCárthaigh wrote:
> On Mon, Jul 28, 2014 at 1:55 AM, Nikos Mavrogiannopoulos
> <nmav@redhat.com> wrote:
> > Are there any pointers to these attacks? Will these attacks be countered
> > with such a change? I believe not as alert messages consist of only two
> > bytes and will be distinct from any other higher protocol messages
> > transferred by the TLS record protocol.
> 
> This is not the case. Firstly, even with a stream cipher it doesn't
> distinguish the message from a 2 byte application data message. But
> most ciphers are block ciphers, and so the true length is fuzzed by
> about an order of magnitude.

On the contrary, all _new_ ciphers are stream (GCM, CCM) and every
future AEAD cipher will be a stream one (due to limitations of the AEAD
construction in TLS). Furthermore, even if you assume that only AES-CBC
is going to be used, do you really consider a 16-byte alert packet
fuzzed? Do you know many application protocols that transfer such short
packets?

regards,
Nikos

Re: [TLS] Encryption of TLS 1.3 content type Yoav Nir
Re: [TLS] Encryption of TLS 1.3 content type Fabrice Gautier
Re: [TLS] Encryption of TLS 1.3 content type Eric Rescorla
[TLS] Encryption of TLS 1.3 content type Joseph Salowey (jsalowey)
Re: [TLS] Encryption of TLS 1.3 content type Watson Ladd
Re: [TLS] Encryption of TLS 1.3 content type Colm MacCárthaigh
Re: [TLS] Encryption of TLS 1.3 content type Juho Vähä-Herttua
Re: [TLS] Encryption of TLS 1.3 content type Peter Gutmann
Re: [TLS] Encryption of TLS 1.3 content type Yoav Nir
Re: [TLS] Encryption of TLS 1.3 content type Nikos Mavrogiannopoulos
Re: [TLS] Encryption of TLS 1.3 content type Yoav Nir
Re: [TLS] Encryption of TLS 1.3 content type Daniel Kahn Gillmor
Re: [TLS] Encryption of TLS 1.3 content type Martin Rex
Re: [TLS] Encryption of TLS 1.3 content type Colm MacCárthaigh
Re: [TLS] Encryption of TLS 1.3 content type Nikos Mavrogiannopoulos
Re: [TLS] Encryption of TLS 1.3 content type Daniel Kahn Gillmor
Re: [TLS] Encryption of TLS 1.3 content type Nikos Mavrogiannopoulos
Re: [TLS] Encryption of TLS 1.3 content type Viktor Dukhovni
Re: [TLS] Encryption of TLS 1.3 content type Brian Sniffen
Re: [TLS] Encryption of TLS 1.3 content type Stephen Farrell
Re: [TLS] Encryption of TLS 1.3 content type Michael StJohns
Re: [TLS] Encryption of TLS 1.3 content type Yoav Nir
Re: [TLS] Encryption of TLS 1.3 content type Colm MacCárthaigh
Re: [TLS] Encryption of TLS 1.3 content type Eric Rescorla
Re: [TLS] Encryption of TLS 1.3 content type Andy Lutomirski
Re: [TLS] Encryption of TLS 1.3 content type Peter Gutmann
Re: [TLS] Encryption of TLS 1.3 content type Alfredo Pironti
Re: [TLS] Encryption of TLS 1.3 content type Martin Rex
Re: [TLS] Encryption of TLS 1.3 content type Alfredo Pironti