Re: [TLS] Rethink TLS 1.3

[Henrick Hellström <[e-mail]>]

On 2014-11-24 11:42, Nico Williams wrote:
> On Mon, Nov 24, 2014 at 11:30:58AM +0100, Henrick Hellström wrote:
>> Actually, no, it doesn't. The Internet threat model is based on the
>> premise that both ends are uncompromised. If the client is allowing
>> third party javascript to connect to arbitrary HTTPS servers,
>> impersonating the client that runs the script, that client is
>> compromised.
>
> The Internet threat model always will have to assume local security.
>
> We're designing TLS.  We are not really in a prosition to dictate to
> applications that they must not use cookies (though we can and must
> state clearly what applications can expect from TLS), especially not
> since we can (and must) make TLS 1.3 resistant to BEAST/CRIME style
> attacks (we shouldn't make apps change unnecessarily).  This is NOT a
> defense of the web security model, BTW, please don't mistake it as such.

Yes, but the point I am trying to make, is that if the implied goal is 
to make TLS resilient even against BEAST/CRIME style attacks, the threat 
model should be defined accordingly. It makes little sense to ask for 
cryptographic review of the protocol, if it is inherently unclear 
exactly what kind of threats the protocol is designed to withstand.