IETF Logo Mail Archive

Re: [TLS] Additional warnings on 0-RTT data

"Christian Huitema" <huitema@huitema.net> Thu, 24 November 2016 06:46 UTC

Return-Path: <huitema@huitema.net>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EF88C1294B4 for <tls@ietfa.amsl.com>; Wed, 23 Nov 2016 22:46:04 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -0.703
X-Spam-Level:
X-Spam-Status: No, score=-0.703 tagged_above=-999 required=5 tests=[BAYES_20=-0.001, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1_ri6XdfGLAc for <tls@ietfa.amsl.com>; Wed, 23 Nov 2016 22:46:03 -0800 (PST)
Received: from mx43-out1.antispamcloud.com (mx43-out1.antispamcloud.com [138.201.61.189]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 715A21294AE for <tls@ietf.org>; Wed, 23 Nov 2016 22:46:03 -0800 (PST)
Received: from xsmtp03.mail2web.com ([168.144.250.223]) by mx43.antispamcloud.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.86) (envelope-from <huitema@huitema.net>) id 1c9nnE-0003Xj-Qh for tls@ietf.org; Thu, 24 Nov 2016 07:46:01 +0100
Received: from [10.5.2.13] (helo=xmail03.myhosting.com) by xsmtp03.mail2web.com with esmtps (TLS-1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.63) (envelope-from <huitema@huitema.net>) id 1c9nmB-0005Wu-Bq for tls@ietf.org; Thu, 24 Nov 2016 01:45:58 -0500
Received: (qmail 16252 invoked from network); 24 Nov 2016 06:44:54 -0000
Received: from unknown (HELO icebox) (Authenticated-user:_huitema@huitema.net@[72.235.151.78]) (envelope-sender <huitema@huitema.net>) by xmail03.myhosting.com (qmail-ldap-1.03) with ESMTPA for <colm@allcosts.net>; 24 Nov 2016 06:44:54 -0000
From: Christian Huitema <huitema@huitema.net>
To: 'Colm MacCárthaigh' <colm@allcosts.net>, 'Martin Thomson' <martin.thomson@gmail.com>
References: <CAAF6GDeAbbwnUaCGg4sVxzP6S3ECoQ2nzCi3FyB1gRV9mJHxGA@mail.gmail.com> <CABkgnnXuL9jE04omz3n4FRWBKuJtpEV-bS2tSVvN7AJhW_4GUA@mail.gmail.com> <CAAF6GDcbJm7YWmUZ66JK9hUbU+Gt_-ERmjWxz9YnJe2KCtru-g@mail.gmail.com> <CABkgnnUhnFY5H6ew2uAhvPuqm8E1dP2-9OupaNfvF7qdKvggBg@mail.gmail.com> <CAAF6GDdrPO+eYMmWmvmwL2RVB5UV8184Xc5uOz99PhkkZfNY9w@mail.gmail.com> <CABkgnnVOrCAu0sKNSLJC8FNLXEzZxLNA3dPDPfxc86KWSLvjyQ@mail.gmail.com> <CAAF6GDfg0fO46-NLD0j4p52j-n50w4vmGa1YUBAsow8N+0U=gA@mail.gmail.com>
In-Reply-To: <CAAF6GDfg0fO46-NLD0j4p52j-n50w4vmGa1YUBAsow8N+0U=gA@mail.gmail.com>
Date: Wed, 23 Nov 2016 20:44:51 -1000
Message-ID: <095e01d2461e$4335acc0$c9a10640$@huitema.net>
MIME-Version: 1.0
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
X-Mailer: Microsoft Outlook 16.0
Thread-Index: AQNc1L7s3QDNVvYw7W73bcafb42e8gF73kMlAVkLj7ACXw09ewJgQB2KAlNNRM4BpcQLy512J7QA
Content-Language: en-us
X-Filter-ID: s0sct1PQhAABKnZB5plbIVbU93hg6Kq00BjAzYBqWlUcW8ntawmIBRrYFzUH2lbvx1wTMkEUUoeb KIhkyzl2dP6iToxOOfkkkKBkEi+o3RqBn9PDoOhj/xzb7kHn/aQhIMekNi8AbP1K8LEdFLG4hgtb rTrWS9bemHrYlL1z57yRMRrvVMyrDQSCtfwipYMVGlugeeYNRP+TKatltgBEa/+k51CV8HOoCp+b WB2rXxPubplnbiDyBMUiEvUZuPnV9fApVgk0pB5h/LHiBh+ygEQqMGQOSwmEPwP4wBzM77OTVsmO 6uQQP+Ygzu7SVnOSquGQt1XNpx/AmufzrIpBz2hWDl86FRLsucalajANCROTEtSxjwHNYb/2LiS7 Aj0A9NgR8y+CBDNrETXWklX3dRIys/hHd7B5kQIJ1AmTVHYx2C8r0+n90PgZrVLZ+wLbZRWsGw8a c2InzcAP/gmxwP3syfTP+jLY1VVhnsOCDTCN/zt7adq46on0hk7vnxe46U0LjBzYuQztdAThgtWS U+4HJk0Zr//OJQKDI3aPfhBwB3GYi0UY+a4jCPcjJ1BDE9ykbJ7I9co1MAEE3ruNXvvg7iEFLP+S SY+Av5+AiC7JQKAKt33GE+tScjoV4oVfTWqb7+KkhmCiIKH9ch3Ck2CI2mWbDfKngUUUK5L6TqND iFwiZGp6gasQtfy6Uxde
X-Report-Abuse-To: spam@quarantine5.antispamcloud.com
X-Originating-IP: 168.144.250.223
X-SpamExperts-Domain: xsmtpout.mail2web.com
X-SpamExperts-Username: 168.144.250.0/24
Authentication-Results: antispamcloud.com; auth=pass smtp.auth=168.144.250.0/24@xsmtpout.mail2web.com
X-SpamExperts-Outgoing-Class: unsure
X-SpamExperts-Outgoing-Evidence: Combined (0.22)
X-Classification: unsure/combined
X-Recommended-Action: accept
Archived-At: <https://mailarchive.ietf.org/arch/msg/tls/_eE9O7emmJq0PjMh0ruO966f-4I>
Cc: tls@ietf.org
Subject: Re: [TLS] Additional warnings on 0-RTT data
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.17
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Nov 2016 06:46:05 -0000

On Wednesday, November 23, 2016 7:20 PM, Colm MacCárthaigh wrote:
>
> Prior to TLS1.3, replay is not possible, so the risks are new, but the end-to-end designers
> may not  realize to update their threat model and just what is required. I'd like to spell 
> that out more than what's where at present. 

Uh? Replay was always possible, at the application level. Someone might for example click twice on the same URL, opening two tabs, closing one at random. And that's without counting on deliberate mischief.

-- Christian Huitema

v2.23.0 | Report a Bug | By Email