Re: [TLS] draft-ietf-tls-renegotiation-01.txt and DTLS

[David-Sarah Hopwood <[e-mail]>]

Tolga Acar wrote:
> I looked at DTLS and it doesn't seem like it is vulnerable as TLS is.
> The "uint16 epoch" and "uint48 sequence_number" in the record header are
> input to the MAC and are validated per RFC4347 Section 4.1.2.1. It seems
> to me that a MiTM would not have a  matching epoch+sequence number, the
> MiTM can't change them (ok, may change, but MAC would not validate), and
> it takes 2^48 for them to roll over. So, short of 2^48 bit rollover (and,
> don't forget the message sequence number <uint16> inside the record), I
> don't see how MiTM would work in DTLS.

RFC 4347 section 4.1:

# As with TLS, the sequence number is set to zero after each
# ChangeCipherSpec message is sent.

So there are two ways to apply the attack to DTLS: either using the
third attack scenario described in
<http://tools.ietf.org/id/draft-mrex-tls-secure-renegotiation-03.txt>:

# 3. Two independent TLS sessions Client<->MitM and MitM<->Server
#    are spliced into one single TLS session Client<->Server through
#    TLS renegotiation where the MitM proxies all communication

or by a rollover of the epoch, which is only 16 bits. The latter is
straightforward if the target implementation does not detect rollovers.

-- 
David-Sarah Hopwood  ⚥  http://davidsarah.livejournal.com