Re: [TLS] Changes to draft-ietf-tls-dtls-heartbeat resulting from IESG review

"Dan Harkins" <> Tue, 06 December 2011 18:11 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 6016921F8C0C for <>; Tue, 6 Dec 2011 10:11:02 -0800 (PST)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -6.265
X-Spam-Status: No, score=-6.265 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, IP_NOT_FRIENDLY=0.334, RCVD_IN_DNSWL_MED=-4]
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id vMqpesjOEWHn for <>; Tue, 6 Dec 2011 10:10:52 -0800 (PST)
Received: from ( []) by (Postfix) with ESMTP id 8A50621F8BFE for <>; Tue, 6 Dec 2011 10:10:52 -0800 (PST)
Received: from (localhost []) by (Postfix) with ESMTP id 2818C20054; Tue, 6 Dec 2011 10:10:36 -0800 (PST)
Received: from (SquirrelMail authenticated user by with HTTP; Tue, 6 Dec 2011 10:10:36 -0800 (PST)
Message-ID: <>
In-Reply-To: <>
References: <> <> <> <>
Date: Tue, 6 Dec 2011 10:10:36 -0800 (PST)
From: "Dan Harkins" <>
To: "Nikos Mavrogiannopoulos" <>
User-Agent: SquirrelMail/1.4.14 [SVN]
MIME-Version: 1.0
Content-Type: text/plain;charset=iso-8859-1
Content-Transfer-Encoding: 8bit
X-Priority: 3 (Normal)
Importance: Normal
Subject: Re: [TLS] Changes to draft-ietf-tls-dtls-heartbeat resulting from IESG review
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Tue, 06 Dec 2011 18:11:02 -0000

On Tue, December 6, 2011 8:17 am, Nikos Mavrogiannopoulos wrote:
> On Mon, Dec 5, 2011 at 6:04 PM, Dan Harkins <>; wrote:
>>>> One of the requested changes was to randomize to the data in the
>>>> heartbeat message to attempt to head of any issues occurring from weak
>>>> or flawed ciphers.   Since the change was relatively simple, the
>>>> document was modified even though modern ciphers should not have a
>>>> problem.  Flaws may be discovered in one of the many cipher suites in
>>>> the future.
>>> Are there any papers or cipher documentation discussing how using
>>> randomized data in a packet would solve possible future cipher flaws?
>>  Check out "Deterministic Authenticated Encryption"* by Rogaway and
>> Shrimpton. It defines a cipher mode for key-wrapping but the proof of
>> security (appendix C) is based on the notion of randomized data in the
>> packet-- i.e. that part of the data (the key) being wrapped is random.
> Indeed, but this is not a generic encryption mode like CBC or CTR. It
> is specifically designed to encrypt random keys, and thus depends on
> its randomness. Typical encryption modes are specifically designed to
> prevent someone distinguishing a given plaintext encryption from a
> random one.

  Actually it is a generic encryption mode. It's a generic AEAD scheme
(like GCM or CCM) and has code-points allocated by IANA for AEAD
algorithms defined by RFC 5116:

Unlike other AEAD schemes this one has the benefit of misuse-resistance
(see section 7).

  It is also provably-secure key-wrapping scheme, as you note. I
mention this because it formally addresses the issue of randomness
in the packet and its effect on the security of the cipher mode which
is what I thought you were asking about.

  It's a generic AEAD's a key-wrapping scheme... for a
crypto protocol developer, it's the new SHIMMER!

> Now, if one would like to use a subliminal channel in TLS, the
> heartbeat extension now provides an unbounded channel.

  Well that's a whole different issue....