Re: [TLS] Rethink TLS 1.3

[Nico Williams <[e-mail]>]

On Sat, Nov 22, 2014 at 02:15:30PM -0800, Watson Ladd wrote:
> It's clear what the security claims of TLS are be: a TLS connection
> between two parties ensures that data sent between them isn't
> intercepted or manipulated, and that they are who they claim to be.
> This is a fairly standard notion, clearly present in research by the
> late 80's, and intuitively sensible.

It's the standard Internet threat model.  Aside from needing to be
updated for massive adversay capabilities, the standard Internet threat
model has held up well.  What hasn't held up is TLS:

> Of course, past versions of TLS haven't provided it.
> 
> > In a sense, *every* protocol has the potential of becoming broken,
> > unless it is unambiguously defined what is proper and improper usage
> > of the protocol.

We don't have a crystal ball.  All we have is fairly decent (but almost
certainly incomplete) public understanding of cryptography, and a
fairly decent idea of today's applications' needs.  We can imagine the
near future and plan accordingly, but further out we run into trouble.

I don't think we necessarily need, e.g., an explicit statement that
resistance to BEAST/CRIME style attacks is required: the standard
Internet threat model implies it.  Though it doesn't hurt to list all of
TLS's (and other protocols') vulnerabilities, of course...  It also
helps to design application protocols where BEAST/CRIME type attacks are
of little use.  I.e., we need better session continuation for HTTP than
plain cookies.  But we can't make that happen from the TLS layer, and we
must act accordingly (besides, improving HTTP session continuation has
proven to be a very difficult task).

Nico
--