Re: [TLS] Possible timing attack on TLS 1.3 padding mechanism

Eric Rescorla <ekr@rtfm.com> Fri, 02 March 2018 01:18 UTC

MIME-Version: 1.0
In-Reply-To: <CABkgnnVEMj7DGN0GxtSwWSfyDhhdXfXoiwA8XE6M5xgLAHo-iQ@mail.gmail.com>
References: <16A9FD3A-7805-4130-8438-39D0D3E7E3AB@rhul.ac.uk> <87zi3rs7mh.fsf@fifthhorseman.net> <CABkgnnVEMj7DGN0GxtSwWSfyDhhdXfXoiwA8XE6M5xgLAHo-iQ@mail.gmail.com>
From: Eric Rescorla <ekr@rtfm.com>
Date: Thu, 01 Mar 2018 17:17:22 -0800
Message-ID: <CABcZeBMnxoT1Gq71TNHv0Kq0T9eG=gZP0eAmXobwyD5PdQx_0Q@mail.gmail.com>
To: Martin Thomson <martin.thomson@gmail.com>
Cc: Daniel Kahn Gillmor <dkg@fifthhorseman.net>, "<tls@ietf.org>" <tls@ietf.org>
Content-Type: multipart/alternative; boundary="001a1147a324691864056663bf3f"
Archived-At: <https://mailarchive.ietf.org/arch/msg/tls/TkBeKrinRDGXruMqxyHEqpAL_hM>
Subject: Re: [TLS] Possible timing attack on TLS 1.3 padding mechanism
Precedence: list

On Thu, Mar 1, 2018 at 5:12 PM, Martin Thomson <martin.thomson@gmail.com>
wrote:

> On Fri, Mar 2, 2018 at 10:23 AM, Daniel Kahn Gillmor
> <dkg@fifthhorseman.net> wrote:
> > You could of course check from the front of the plaintext, keeping every
> > non-zero value:
> >
> >   char ptype = 0;
> >   for (i = 0; i < plaintext_len; i++)
> >     if plaintext[i]
> >       ptype = plaintext[i];
>
> What about ?
>
> size_t l[2];
> size_t t[2];
> for (i = 0; i < plaintext_len; ++i) {
>   l[plaintext[i] != 0] = i;
>   t[plaintext[i] != 0] = plaintext[i];
> }
> unpadded_len = l[0] - 1;
> content_type = t[1];

This is fun, but I want to note that many (most) APIs are not zero-copy but
rather involve
SSL_Read() copying data from some internal buffer into a caller supplied
buffer. So
that operation also needs to be made constant time (e.g., by copying the
whole
padded region?), and so on...

-Ekr

_______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls
>

[TLS] cost of padding removal in TLS1.3 [was: Pos… Nikos Mavrogiannopoulos
Re: [TLS] Possible timing attack on TLS 1.3 paddi… Paterson, Kenny
Re: [TLS] Possible timing attack on TLS 1.3 paddi… Eric Rescorla
Re: [TLS] Possible timing attack on TLS 1.3 paddi… Paterson, Kenny
Re: [TLS] Possible timing attack on TLS 1.3 paddi… Colm MacCárthaigh
Re: [TLS] Possible timing attack on TLS 1.3 paddi… David Benjamin
Re: [TLS] Possible timing attack on TLS 1.3 paddi… Daniel Kahn Gillmor
Re: [TLS] Possible timing attack on TLS 1.3 paddi… Martin Thomson
Re: [TLS] Possible timing attack on TLS 1.3 paddi… Eric Rescorla
Re: [TLS] Possible timing attack on TLS 1.3 paddi… Martin Thomson
Re: [TLS] Possible timing attack on TLS 1.3 paddi… Nikos Mavrogiannopoulos
Re: [TLS] Possible timing attack on TLS 1.3 paddi… Paterson, Kenny