Re: [TLS] draft-ietf-tls-renegotiation-01.txt and DTLS

On Nov 30, 2009, at 7:31 PM, Kyle Hamilton wrote:

> I would support randomizing the epoch counter in DTLS, giving a 1:2^16
> chance of getting it right in a single attempt.  (This follows my
> observation that the hash saved from the last Finished message is
> essentially the same as a named epoch.)
Who chooses the epoch randomly, how does the peer know this value?

Best regards
Michael
> 
> -Kyle H
> 
> On Mon, Nov 30, 2009 at 10:29 AM, Eric Rescorla
> <ekr@networkresonance.com> wrote:
>> At Mon, 30 Nov 2009 12:06:02 -0600,
>> Marsh Ray wrote:
>>> 
>>> Michael Tüxen wrote:
>>>> 
>>>> If I'm not wrong, then the attack which works against TLS does not
>>>> work against DTLS, since DTLS has an epoch counter.
>>>> 
>>>> If a client tries to establish a DTLS connection and a MITM intercepts
>>>> it, establishes itself a DTLS connection, the epoch is 1. There will be
>>>> a final mismatch in the epoch and the packets will be discarded. When
>>>> using the RI extension one could enforce the sending of the alert message.
>>>> But the original attack is not possible, I think.
>>>> 
>>>> Is my analysis correct or am I overlooking something?
>>> 
>>> Can MitM do the same number of renegotitations as he does with the
>>> server before splicing him?
>> 
>> Nagendray and I had this conversation last week. While I haven't done
>> a complete analysis, my intuition is that DTLS is more resistant (for
>> the reason you indicate) but not 100% resistant.  Another concern
>> would be epoch rollover: what if you do 65536 (65535?--too lazy to
>> calculate) handshakes with the server and force the epoch back to 0?
>> 
>> So, probably better to use RI with DTLS as well.
>> 
>> -Ekr
>> _______________________________________________
>> TLS mailing list
>> TLS@ietf.org
>> https://www.ietf.org/mailman/listinfo/tls
>> 
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls