Re: [TLS] Changes to draft-ietf-tls-dtls-heartbeat resulting from IESG review

["Dan Harkins" <[e-mail]>]

On Tue, December 6, 2011 8:17 am, Nikos Mavrogiannopoulos wrote:
> On Mon, Dec 5, 2011 at 6:04 PM, Dan Harkins <[e-mail]> wrote:
>
>>>> One of the requested changes was to randomize to the data in the
>>>> heartbeat message to attempt to head of any issues occurring from weak
>>>> or flawed ciphers.   Since the change was relatively simple, the
>>>> document was modified even though modern ciphers should not have a
>>>> problem.  Flaws may be discovered in one of the many cipher suites in
>>>> the future.
>>> Are there any papers or cipher documentation discussing how using
>>> randomized data in a packet would solve possible future cipher flaws?
>>  Check out "Deterministic Authenticated Encryption"* by Rogaway and
>> Shrimpton. It defines a cipher mode for key-wrapping but the proof of
>> security (appendix C) is based on the notion of randomized data in the
>> packet-- i.e. that part of the data (the key) being wrapped is random.
>
> Indeed, but this is not a generic encryption mode like CBC or CTR. It
> is specifically designed to encrypt random keys, and thus depends on
> its randomness. Typical encryption modes are specifically designed to
> prevent someone distinguishing a given plaintext encryption from a
> random one.

  Actually it is a generic encryption mode. It's a generic AEAD scheme
(like GCM or CCM) and has code-points allocated by IANA for AEAD
algorithms defined by RFC 5116:

http://www.iana.org/assignments/aead-parameters/aead-parameters.xml

Unlike other AEAD schemes this one has the benefit of misuse-resistance
(see section 7).

  It is also provably-secure key-wrapping scheme, as you note. I
mention this because it formally addresses the issue of randomness
in the packet and its effect on the security of the cipher mode which
is what I thought you were asking about.

  It's a generic AEAD mode...it's a key-wrapping scheme... for a
crypto protocol developer, it's the new SHIMMER!

http://www.nbc.com/saturday-night-live/video/shimmer-floor-wax/1056743/

> Now, if one would like to use a subliminal channel in TLS, the
> heartbeat extension now provides an unbounded channel.

  Well that's a whole different issue....

  Dan.