Re: [TLS] 2nd WGLC: draft-ietf-tls-tls13

[Kyle Nekritz <[e-mail]>]

Timestamps outside the expected window can happen due to variances in RTT, client clock skew, etc. (we see around .1% of clients outside of a 30s window for example). Not likely to happen on a given connection, but it certainly happens enough that you don’t want to abort the connection (rather than allowing 1-RTT) without reason. I’m not sure I understand the desire to abort these connections. What value does it provide? The timestamp mechanism does not provide protection against a malicious client that has possession of the PSK key.

If the server is 100% sure that a CH is replayed it is more reasonable to abort the connection, but I think it should be explicit to the client that that is the reason for the error (ie using a new alert type rather than illegal_parameter) so the client can know to retry without 0-RTT. I’m also slightly concerned that it allows a passive attacker to cause connection failures if it can front-run a copy of the CH to the server, and I still don’t think it is providing much value.

From: TLS [mailto:[e-mail]] On Behalf Of Benjamin Kaduk
Sent: Tuesday, July 18, 2017 2:11 PM
To: Eric Rescorla <[e-mail]>
Cc: <[e-mail]> <[e-mail]>
Subject: Re: [TLS] 2nd WGLC: draft-ietf-tls-tls13

On 07/18/2017 08:07 AM, Eric Rescorla wrote:



On Wed, Jul 12, 2017 at 3:39 PM, Benjamin Kaduk <[e-mail]<mailto:[e-mail]>> wrote:

That is, in this case, the CH+0RTT data can be replayed by an observer once enough time has elapsed that the expected_arrival_time is within the window, similar to one of the reordering attacks mentioned elsewhere.  We could add the CH to the strike register in this case, which would bloat its storage somewhat and have entries that take longer than the window to expire out.

I don't have a good sense for how often we expect postdated CHs to occur and whether the ensuing breakage would be manageable, but I'm not sure that we've thought very hard as a group about this question.

I think post-dated are going to happen pretty often based on what I understand from
Kyle and others. I wouldn't be comfortable with hard fail, especially given that this
just seems like the dual of the other case. Adding the CH to the list seems like
a problem because it might stay forever.


The "stay forever" part is awkward, yes.  It would be great if Kyle/etc. could say a bit about why post-dated seems likely on the list, but I guess for the purposes of WGLC we can consider this comment resolved.

-Ben