Re: [TLS] Choice of Additional Data Computation

Hanno Becker <Hanno.Becker@arm.com> Fri, 24 April 2020 22:00 UTC

Return-Path: <Hanno.Becker@arm.com>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 600743A0D45 for <tls@ietfa.amsl.com>; Fri, 24 Apr 2020 15:00:21 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.899
X-Spam-Level:
X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, SPF_PASS=-0.001, UNPARSEABLE_RELAY=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=armh.onmicrosoft.com header.b=MGEBbRf6; dkim=pass (1024-bit key) header.d=armh.onmicrosoft.com header.b=MGEBbRf6
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id a4bIDHuc8n4t for <tls@ietfa.amsl.com>; Fri, 24 Apr 2020 15:00:15 -0700 (PDT)
Received: from EUR04-DB3-obe.outbound.protection.outlook.com (mail-eopbgr60065.outbound.protection.outlook.com [40.107.6.65]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 11AD03A0D43 for <tls@ietf.org>; Fri, 24 Apr 2020 15:00:14 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=armh.onmicrosoft.com; s=selector2-armh-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=YyvxClrbuEKZ+lH13y0SbMsbJFYam0K3rVJYp2RIjLU=; b=MGEBbRf6ENrFycatTItIEBacL0Nt8Xs44QgFaATd+akZ4rbF8FTGiJIsxy28WXhOQebWmieqbX5DgkIYDyq6MjqajnroHXHUWhMuBqSMmeRcNzZIQWVuOH7q5CeoY/rQybnf5GlkezMzkroJu/fUmmDSHFT9dGAzyUKEnr/+87k=
Received: from AM7PR03CA0025.eurprd03.prod.outlook.com (2603:10a6:20b:130::35) by DB6PR0801MB1943.eurprd08.prod.outlook.com (2603:10a6:4:74::20) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2937.13; Fri, 24 Apr 2020 22:00:11 +0000
Received: from AM5EUR03FT042.eop-EUR03.prod.protection.outlook.com (2603:10a6:20b:130:cafe::66) by AM7PR03CA0025.outlook.office365.com (2603:10a6:20b:130::35) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2937.13 via Frontend Transport; Fri, 24 Apr 2020 22:00:11 +0000
Authentication-Results: spf=pass (sender IP is 63.35.35.123) smtp.mailfrom=arm.com; ietf.org; dkim=pass (signature was verified) header.d=armh.onmicrosoft.com;ietf.org; dmarc=bestguesspass action=none header.from=arm.com;
Received-SPF: Pass (protection.outlook.com: domain of arm.com designates 63.35.35.123 as permitted sender) receiver=protection.outlook.com; client-ip=63.35.35.123; helo=64aa7808-outbound-1.mta.getcheckrecipient.com;
Received: from 64aa7808-outbound-1.mta.getcheckrecipient.com (63.35.35.123) by AM5EUR03FT042.mail.protection.outlook.com (10.152.17.168) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2937.19 via Frontend Transport; Fri, 24 Apr 2020 22:00:11 +0000
Received: ("Tessian outbound b3a67fbfbb1f:v54"); Fri, 24 Apr 2020 22:00:11 +0000
X-CheckRecipientChecked: true
X-CR-MTA-CID: 3a519c655b029302
X-CR-MTA-TID: 64aa7808
Received: from b3539b79d38e.2 by 64aa7808-outbound-1.mta.getcheckrecipient.com id 2ADB6AC4-D053-4EA6-90CE-8D76D0A34A7D.1; Fri, 24 Apr 2020 22:00:05 +0000
Received: from EUR05-DB8-obe.outbound.protection.outlook.com by 64aa7808-outbound-1.mta.getcheckrecipient.com with ESMTPS id b3539b79d38e.2 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384); Fri, 24 Apr 2020 22:00:05 +0000
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=i9Z3K5e3uz+t3GuHXmCN9TdpnSnqlnwj8rmZNP4wz14nuYfe41UhGbX5alYhOigt/2k9TtiCkvxZ13TFaBEp2Jz6liqA3j89nIZLPpdDNOOJSY5bZR1hzpiBFB2XCE6w/vrn2Ytm7S1wNNsw53Otd2GFObJCe+zUrZwwv1VQk934eBSoFlX4daHU+ohhSKNiaaDUfSLswdAhdJJAk+V/J24XaYZPxCmBDvg4AiDjSsIv1F4elZpxCqJqcqQ6FSeXGPG52BCZi/dWK3JDbNlr1ASOooeqF6YCUv8vDulqkcQOp7Ctd5S46xPvwM2eqyjEhhpCNaLXDOASyru1jtq27Q==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=YyvxClrbuEKZ+lH13y0SbMsbJFYam0K3rVJYp2RIjLU=; b=mT7V4JdjHCGPvvuiy0VrEC8fy91cO+SKbsJtqR9BDDGEQM8gJCmRESGgq83DnLURncfwZeEOYRiurVeBDNl+p/puFFTXOFYWZgVmlxGdZcLwUP+onfhinQA6V2DRrg3zz8KDCozclFU9wicUlp01+Kh2oCr22rvr3Xg+gvvm5kSF+g7lAnUD6sYsHaRzZP59PkL9O7bx3g+kRkw9fDPUVp9j0Dc2wW17YVcIVprk8MEI/J85laaohe7rRMWpVOEsfhlPCe9SN/nfbr4ANQlChToVi5yiAjmKVv3wCcvG1VoHg8lgDqatlQqyWqyjmkWcDgksZSjwp89Vxxs10tMmPQ==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=arm.com; dmarc=pass action=none header.from=arm.com; dkim=pass header.d=arm.com; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=armh.onmicrosoft.com; s=selector2-armh-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=YyvxClrbuEKZ+lH13y0SbMsbJFYam0K3rVJYp2RIjLU=; b=MGEBbRf6ENrFycatTItIEBacL0Nt8Xs44QgFaATd+akZ4rbF8FTGiJIsxy28WXhOQebWmieqbX5DgkIYDyq6MjqajnroHXHUWhMuBqSMmeRcNzZIQWVuOH7q5CeoY/rQybnf5GlkezMzkroJu/fUmmDSHFT9dGAzyUKEnr/+87k=
Received: from AM6PR08MB3318.eurprd08.prod.outlook.com (2603:10a6:209:45::15) by AM6PR08MB4866.eurprd08.prod.outlook.com (2603:10a6:20b:c8::15) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2937.13; Fri, 24 Apr 2020 22:00:05 +0000
Received: from AM6PR08MB3318.eurprd08.prod.outlook.com ([fe80::1579:b7d9:f543:200d]) by AM6PR08MB3318.eurprd08.prod.outlook.com ([fe80::1579:b7d9:f543:200d%5]) with mapi id 15.20.2937.020; Fri, 24 Apr 2020 22:00:05 +0000
From: Hanno Becker <Hanno.Becker@arm.com>
To: Eric Rescorla <ekr@rtfm.com>, chris - <chrispatton@gmail.com>
CC: Hannes Tschofenig <Hannes.Tschofenig@arm.com>, "tls@ietf.org" <tls@ietf.org>
Thread-Topic: [TLS] Choice of Additional Data Computation
Thread-Index: AdYaKASVCp3JPFQuSaOSMkwtz/VZZwAEUEsAAAN7oaAAAnFQAAAASY9CAAFcJQAAAoyFgAAAY+d9AADW9gAAAKxogAAAKW2AAAULeAA=
Date: Fri, 24 Apr 2020 22:00:04 +0000
Message-ID: <AM6PR08MB3318AFD0C1FC4011ED2A81919BD00@AM6PR08MB3318.eurprd08.prod.outlook.com>
References: <AM0PR08MB371694E826FA10D25F2BA53EFAD00@AM0PR08MB3716.eurprd08.prod.outlook.com> <93042b37-37e1-5b6a-3578-a750054d0507@gmx.net> <AM0PR08MB3716541F4825F8D43DC3D308FAD00@AM0PR08MB3716.eurprd08.prod.outlook.com> <CACLV2m4-Qcx-xKWP201VCY73HVyjCzHVCb6PrntnBWhA8fBQYg@mail.gmail.com> <AM6PR08MB3318B6ABD411C8C476C3D10B9BD00@AM6PR08MB3318.eurprd08.prod.outlook.com> <CABcZeBOwK7m465LsbY3U+bHv0XA2rcGOTEBStTtTNkwAYvWeQA@mail.gmail.com> <CACLV2m5Md2+Ffc978ZJ+BeZwRgcXTV3xE0vXzmvNgnot_c71xQ@mail.gmail.com> <AM6PR08MB331862B6F143652F4B4C10EE9BD00@AM6PR08MB3318.eurprd08.prod.outlook.com> <CABcZeBMKoVrcN-=aTvy6py5bhOwOVrhgVLmtX2tthc=Oa54b_Q@mail.gmail.com> <CACLV2m7knyt-gQoQq2v1Kz-J62DPjCpb6faJFfDgJ-8mprHwxQ@mail.gmail.com>, <CABcZeBMwQHdRuvcs5pmE59SCUj=cwWCtrBhyh9w_L0U1ZDoJ8Q@mail.gmail.com>
In-Reply-To: <CABcZeBMwQHdRuvcs5pmE59SCUj=cwWCtrBhyh9w_L0U1ZDoJ8Q@mail.gmail.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
Authentication-Results-Original: spf=none (sender IP is ) smtp.mailfrom=Hanno.Becker@arm.com;
x-originating-ip: [2a00:23c5:ee06:1300:75ff:a3e1:66f3:b1ab]
x-ms-publictraffictype: Email
X-MS-Office365-Filtering-HT: Tenant
X-MS-Office365-Filtering-Correlation-Id: 0f186353-9022-4348-1939-08d7e89adc30
x-ms-traffictypediagnostic: AM6PR08MB4866:|AM6PR08MB4866:|DB6PR0801MB1943:
x-ms-exchange-transport-forked: True
X-Microsoft-Antispam-PRVS: <DB6PR0801MB194339748F2D501416CE2BE69BD00@DB6PR0801MB1943.eurprd08.prod.outlook.com>
x-checkrecipientrouted: true
nodisclaimer: true
x-ms-oob-tlc-oobclassifiers: OLM:9508;OLM:10000;
x-forefront-prvs: 03838E948C
X-Forefront-Antispam-Report-Untrusted: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:AM6PR08MB3318.eurprd08.prod.outlook.com; PTR:; CAT:NONE; SFTY:; SFS:(4636009)(39860400002)(136003)(366004)(376002)(396003)(346002)(8936002)(478600001)(81156014)(55016002)(8676002)(5660300002)(4326008)(9686003)(7696005)(110136005)(6506007)(316002)(54906003)(33656002)(76116006)(71200400001)(86362001)(2906002)(66556008)(186003)(52536014)(64756008)(66946007)(66476007)(66446008); DIR:OUT; SFP:1101;
received-spf: None (protection.outlook.com: arm.com does not designate permitted sender hosts)
X-MS-Exchange-SenderADCheck: 1
X-Microsoft-Antispam-Untrusted: BCL:0;
X-Microsoft-Antispam-Message-Info-Original: efPxKjw7XK5lQYshr9FyP53tage9r7nU2BQluIZ0+LbNHpTPpp5bf0EM2uaNV4/fl8lxe/lH5TwUKXr+woiG0N/50F1kAqfjsIPAFdSx4A/aPFVhoGREMExM56Ffs1oK1Mh7/OEWSQUuIt4/SsF2BuOppPLH7d7kk3qBD6O4oFAieNe6lD3noVy8jdxI4Gz+GBbVa88UTabXzdQ5k1fqwuqwojB/S/8uw0GqIhogJwbhPi8Jq2FrYJOKoA5Yjsxd5ykqT0oZQR2kwWzCGQpCmGSxCGdFjuoqS/mbDeSW5Pj61XUicClX/pNNv/fuWim1tkpalQzEFpelTUSFswQ1K5suvnxl4Pcet5AT5s3OJAIVDr4VZ38SVJ1fMTbH9oGCah93A7+QpQEgom7qS7k6unY7y3BLdd0d3DDa3Gn499JwLuG3w36cNZYA8YN0H/6s
x-ms-exchange-antispam-messagedata: cdqOJT4hgYo2Kqlq3AcIyXfbOSnGbGm+TasuNb4yMle85hH6LJB3H/aosXlmYQuhxlxmF7MOtFo3iKVn4R1DQlRooWItRwbskiLVvslSKAsugU4uqtbMVn4gAGD3jT6eFbCWaJKUAA0Ub89l3oscdTyyFDnSJYsI+Q6SnxwriNZCqayW8O/i3RTlIMlcJiT/NPHP0EpBt1qv6Zt0fcppHw==
Content-Type: multipart/alternative; boundary="_000_AM6PR08MB3318AFD0C1FC4011ED2A81919BD00AM6PR08MB3318eurp_"
MIME-Version: 1.0
X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM6PR08MB4866
Original-Authentication-Results: spf=none (sender IP is ) smtp.mailfrom=Hanno.Becker@arm.com;
X-EOPAttributedMessage: 0
X-MS-Exchange-Transport-CrossTenantHeadersStripped: AM5EUR03FT042.eop-EUR03.prod.protection.outlook.com
X-Forefront-Antispam-Report: CIP:63.35.35.123; CTRY:IE; LANG:en; SCL:1; SRV:; IPV:CAL; SFV:NSPM; H:64aa7808-outbound-1.mta.getcheckrecipient.com; PTR:ec2-63-35-35-123.eu-west-1.compute.amazonaws.com; CAT:NONE; SFTY:; SFS:(4636009)(136003)(396003)(346002)(376002)(39860400002)(46966005)(26005)(81156014)(4326008)(70206006)(9686003)(55016002)(47076004)(82740400003)(186003)(336012)(33656002)(86362001)(70586007)(81166007)(5660300002)(316002)(478600001)(82310400002)(8936002)(36906005)(8676002)(6506007)(356005)(54906003)(110136005)(7696005)(52536014)(2906002); DIR:OUT; SFP:1101;
X-MS-Office365-Filtering-Correlation-Id-Prvs: 5a799a6b-ccc1-4cbd-2b3f-08d7e89ad874
X-Forefront-PRVS: 03838E948C
X-Microsoft-Antispam: BCL:0;
X-Microsoft-Antispam-Message-Info: 202m3f/qh9/584Eo7c+A9cgPKaqAz0k2Mna5iMPerywa4ZBvkT8WfFI0/4CDzy1Nb/N1vu1FOCpPQknu1ePKYCyyvWbvZgXG/BVH9xb5R5Vv7uuAH5SSCsHSjyL6V7ZEfNA6SmZmbV0e+s0z0Ht4AviHy/pmxz/WogcYVXBHMWPqeXUsK+a6/5HumX5/QWNBwfKoFHF3xSBmyRfzd+dO0Jd8yM14slSCGxbxM/eYrKjSlBa7wH3esexiw5bIUjy3S+A7L0IOBEXIsSBe9no9MoMB+PjCAV94ww6HscBCXbVe3do5DLcPQyqI0A1sLxmKCFIxzuKdeWeodw7tC3vp60SdgNYmPdkDMmkZawVNtasu0UFro5A6ydaAKy0tv58h+xSBHk1Ph0YEtdffbe+bVn/bw6TTn8i5k8N91V3xkWuwgrF+hx/uCBXngXtc0SDpzs+uOjBXMpE5st+XitI2lGRDdfYfumdwnQzUMBs6ciYYs+/bAgMBq98I3iugHSYjshpxPJghNNbQShp9IpTvQA==
X-OriginatorOrg: arm.com
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 24 Apr 2020 22:00:11.2382 (UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: 0f186353-9022-4348-1939-08d7e89adc30
X-MS-Exchange-CrossTenant-Id: f34e5979-57d9-4aaa-ad4d-b122a662184d
X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=f34e5979-57d9-4aaa-ad4d-b122a662184d; Ip=[63.35.35.123]; Helo=[64aa7808-outbound-1.mta.getcheckrecipient.com]
X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB6PR0801MB1943
Archived-At: <https://mailarchive.ietf.org/arch/msg/tls/oG-FQNuWKjr-NAEMfAVoRkwjEDY>
Subject: Re: [TLS] Choice of Additional Data Computation
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 24 Apr 2020 22:00:22 -0000

Hi,

Thanks for your input Chris, this is very helpful.

Yes, this is the way I see it. I think you can get by with implicitly authenticating things, but when you start doing this, the details of how to decode the data on the wire begin to really matter for the proof (and potentially for an attacker). This can get complicated if, as you say, the header's content is highly variable. So, I would recommend authenticating what's on the wire. I don't think it would hurt to authenticate more than this, e.g., other fields that the sender and receiver need to agree on.

So far I fail to understand, on an intuitive level, why it easier to analyze the protocol when the AAD can take multiple forms potentially truncating or omitting the underlying data, but then I don't know the details and you're the expert here. If you have time though to explain a bit more where the flaw in my thinking below is, that would be great, provided it's possible.

For example, another thing which I would expect to be more complicated to verify in full rigor is epoch authentication: If the epoch is reduced to its two low order bits in the DTLS 1.3 header and thus (at the moment) also in the AAD, arguing that decryption can only succeed for the correctly expanded epoch involves knowing that all epochs having different keys. That's of course true but this fact wouldn't be needed if the full numeric epoch was always explicitly authenticated in the AAD. This isn't a real issue in the end, but I would expect it to be a nuisance in a formal proof?
In terms of what you mentioned regarding decoding details, it seems that adding the underlying logical header to the AAD ensures more directly that decryption can only succeed if header decoding (that is, filling in implicit data or expanding truncated data) was done correctly, whereas it is less clear with the truncated or omitted data in AAD, as in the epoch example above. Is it possible to explain what the flaw is here intuitively?

Thanks again,
Hanno
IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.