Re: [TLS] Security review of TLS1.3 0-RTT

[Colm MacCárthaigh <[e-mail]>]

On Thu, May 4, 2017 at 2:27 PM, Kyle Nekritz <[e-mail]> wrote:

>
> There are definitely cases (i.e. application profiles) where this should
> be done. I think a general case HTTPS server is one. But I don’t think this
> is strictly necessary across the board (for every application using 0-RTT
> at all). DNS was brought up earlier in this thread as an example of a
> protocol that is likely quite workable without extra measures to prevent
> replay.
>

I thought some more about DNS since yesterday and I'm not sure it is
workable. How would we protect DNS against attack 4 (cache replay) -
couldn't it lead to disclosure of what the request was for? When used
against caches I mean, which is common, and DNS-over-TLS is designed mainly
for privacy, so that actually seems like a show-stopper.


> I also consider it quite misleading to say TLS 1.3 is insecure without
> such a recommendation. Uses of TLS can be insecure, that does not mean the
> protocol itself is. It’s insecure to use TLS without properly
> authenticating the server. Some users of TLS do not do this correctly. I’d
> actually argue that it is easier to mess this up than it is to mess up a
> 0-RTT deployment (and it can result in worse consequences). That doesn’t
> mean we should require a particular method of authentication, for all uses
> of TLS.
>

Here's how I think about it. Each of the attacks in the review is more
practical than Lucky13. More practical in the sense that I could do them in
a real-world setting. In my view at least.

Lucky13 was serious enough to prompt us all to accelerate turning of the
MtE cipher suites. Even though this actually made traffic analysis attacks
easier. Collectively we took a look at it and decided it was on too shaky
ground and we considered it insecure. And so the MtE suites went away.

I can't find a way then, in that context, to see replay as anything other
than a straightforward security issue. Replay is bad, it breaks things,
that's why we go to lengths to prevent it, it's not ok to just for get
about that. If TLS allows replay, TLS is insecure. Remembering that TLS is
a transport layer protocol, not an application layer one.

An application can use RC4 at the TLS layer if it provides its own
application-layer encryption, but we don't consider that secure. We don't
look for cases where applications can make special exceptions; because
that's fraught with sharp edges. We make the default secure.

-- 
Colm