Re: [TLS] TLS1.3

[Nikos Mavrogiannopoulos <[e-mail]>]

On Fri, Feb 8, 2013 at 11:48 AM, Peter Gutmann
<[e-mail]> wrote:

>>Padding the plain text up to a multiple of the cipher block size (minus the
>>hash size) ahead of doing the MAC is a more modest change that may be more
>>widely applicable to existing cipher suites - with a "pad-then MAC" client
>>hello
> That won't help against the current attack.

This family of attacks relies on the fact that padding isn't
authenticated, i.e, you can play with it without being detected. If
pad is part of the MAC there is no issue.

> The only proper fix for the
> various attacks that target the encryption is to protect everything with the
> MAC, i.e. switch to encrypt-then-MAC.  The definitive reference for this is
> Hugo Krawczyk's "The Order of Encryption and Authentication for Protecting
> Communications (Or: How Secure is SSL?)".

Using encrypt-then-MAC to counter the attack is as radical change as
using the GCM or CCM modes. This isn't a small fix, it is an upgrade
which changes the protocol semantics (e.g. MAC is no longer encrypted
- whatever that may mean). Moreover, encrypt-then-MAC isn't a panacea.
There is nothing wrong with MAC-then-encrypt, it is TLS that applied
it incorrectly by keeping the pad unauthenticated. I'd prefer a fix
that keeps the current protocol semantics.

regards,
Nikos