[TLS] Forged RST (was: About encrypting SNI)

[Alyssa Rowan <[e-mail]>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

On 16/04/2014 21:34, Jacob Appelbaum wrote:

> […] and that often results in say, a forged TCP RST packet.

Which, incidentally, we should consider something to address,
especially if we do indeed have a bakeoff of some form for a fancier
TLSv2.0.

NSA calls this technique QUANTUMSKY (one of their less catchy cover
names) but it's been around for aeons (most famously in the Chinese
'Golden Shield'): any man-on-the-side can simply RST your TCP
connections if they don't like the way they smell, and this is (by
far) the cheapest and easiest way for a nation state adversary (or
malicious coffee shop WiFi) to selectively disrupt, or censor,
communications.

Could we plug that hole in a future version of TLS?

The obvious way involves UDP, and baking transport control (and
multiplexing?) inside that layer, within the encryption. In fact it's
so obvious, everyone likes to cook up their own recipe: lots of people
have done something in that general area already in different ways,
and discovered interesting things about it (Google's QUIC being one
notable recent foray into the field). UDP is also notably better for
connections through NAT and suchlike. (I've even done my own
experiments in that general direction, although delicious and moist as
they seem to be, they're simply experiments and I'm not yet ready to
serve them to guests, let alone strangers!)

It also results in something that probably looks more like DTLS than
anything we have now, or something even stranger, or like nothing
anyone can recognise.

It may, or very well may not, be a good idea (gleefully gratuitously
rampant layering violation/wheel reinvention vs. avoiding unnecessary
insecure layers vulnerable to a real, deployed attack/square wheel),
but I'd be interested (with no particular hurry) if anyone had had any
thoughts in that direction.

- -- 
/akr
-----BEGIN PGP SIGNATURE-----

iQIcBAEBCgAGBQJTTwoyAAoJEOyEjtkWi2t6/eoQAKlvRCFsqyZI3pwWG1929+5u
zn23iFhpZBo7Yna9ATUpdGGXUAGr6r3SC2gemyezNlyRsKWG7HPWq1dBbseT+Ubp
fRVsCS2qsCty6v7ZB/uMxs9uxEucRudZN6ibJ0J9IoC22TsC8O/2NuXr5uuvVahd
+Dk8k2dgXmf9NFXgjLmweneX+lI7rjVctSfJM5OmkJ9sz5GKzpxkaR0k7rwLHu23
L1sKyUGOJjam7LsA8wGOgQyCx3wCfqcFwtVECn5P+xpLaOfFznulvD56aXm+MGNO
nM4OVAzErrqtYNJJL48YgR3XCrQ+6fU1Gu1A3KNS2uCzrnJO9nTBLS3uR4FEvxLL
XrLxeol8+Csh+QQjvX3x/sGDZBX3jUhoNchqUP+u5Vl/+ca6T85k1A5GNI5tY5yG
kMec1vLcpsVTYvi9CDV8HjhTnCU5tsueyVkpNWW141UtbNF8VxdGnqSqj7VBysPh
cAAc4AOb2GuD7c5RdYsUvp3vEeuUgnewkOLDLW2W+uBbLHh3hDB4egy3B2HlxGFN
/jlK2ZXgba4pcReI9PU7c4QSQjpdFB213B1WLt3rGen9aUlTAr1HESbMt0PIxpyQ
hEu7uYIaxjj/n/j/R1A2FiIhkFY9K07WqXSIjAdPRQU2cAiyljBZ76Yg9tQwYKXj
EzCJFwn2UX1OzVhmhaG6
=aDNf
-----END PGP SIGNATURE-----