Re: [TLS] Another IRINA bug in TLS

Peter Gutmann <pgut001@cs.auckland.ac.nz> Sun, 24 May 2015 09:55 UTC

Return-Path: <pgut001@cs.auckland.ac.nz>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BB3331A89B9 for <tls@ietfa.amsl.com>; Sun, 24 May 2015 02:55:34 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.91
X-Spam-Level:
X-Spam-Status: No, score=-1.91 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, T_RP_MATCHES_RCVD=-0.01] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5P3RPIU6mtzi for <tls@ietfa.amsl.com>; Sun, 24 May 2015 02:55:30 -0700 (PDT)
Received: from mx4.auckland.ac.nz (mx4.auckland.ac.nz [130.216.125.248]) (using TLSv1 with cipher RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5634B1A89D3 for <tls@ietf.org>; Sun, 24 May 2015 02:55:29 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=auckland.ac.nz; i=@auckland.ac.nz; q=dns/txt; s=mail; t=1432461330; x=1463997330; h=from:to:cc:subject:date:message-id:references: in-reply-to:content-transfer-encoding:mime-version; bh=scsmZv8nD2MotyYiLwZ4SdbXMDCQgtID4ERj+CbH+9I=; b=e71fIl16vLQPu/1FkVx0CbUMsf9ccJR1SnbVOxwRwkDVDt03EyhyjcNW oVwvRFj8+JTvmLb+hWRXcvmkfQ3glkhV3hcEu8dk8KijIBuI5R3ImPsu6 GIbpNqRZlFWDjlNhF13Cx/mHdIh5C/Pdorhu8TozV4MjJPHNj+VeCsHUb wzyvgsJONS3kdQbDI6kayp2y/8ofx4B03M70+ceoDCFjR4+/VUw8pYo1O k3eN3GflFKAetRR5js3adVNIeD0ODx+xOvfgz9iLojxdTjy+dytCgh973 O9krTbTMjQzALt0rYryyyxCacqsIS0yEgZzFLSfB0CN+uH2eacE3ax88v w==;
X-IronPort-AV: E=Sophos;i="5.13,485,1427713200"; d="scan'208";a="17973073"
X-Ironport-HAT: MAIL-SERVERS - $RELAYED
X-Ironport-Source: 130.216.4.112 - Outgoing - Outgoing
Received: from uxchange10-fe1.uoa.auckland.ac.nz ([130.216.4.112]) by mx4-int.auckland.ac.nz with ESMTP/TLS/AES128-SHA; 24 May 2015 21:55:25 +1200
Received: from UXCN10-TDC05.UoA.auckland.ac.nz ([169.254.9.151]) by uxchange10-fe1.UoA.auckland.ac.nz ([130.216.4.112]) with mapi id 14.03.0174.001; Sun, 24 May 2015 21:55:24 +1200
From: Peter Gutmann <pgut001@cs.auckland.ac.nz>
To: Karthikeyan Bhargavan <karthikeyan.bhargavan@inria.fr>
Thread-Topic: [TLS] Another IRINA bug in TLS
Thread-Index: AdCUn0KvC4ozoUHOQIKcwi120/Yv8P//W1SAgANHxkD//zphAIAA8y8g
Date: Sun, 24 May 2015 09:55:24 +0000
Message-ID: <9A043F3CF02CD34C8E74AC1594475C73AB02AB87@uxcn10-tdc05.UoA.auckland.ac.nz>
References: <9A043F3CF02CD34C8E74AC1594475C73AB029727@uxcn10-tdc05.UoA.auckland.ac.nz>, <CAH8yC8=F3jJgEzFQSN=ZMvoC4zunAsfHPs1k2km9dvFJ0bvg2g@mail.gmail.com> <9A043F3CF02CD34C8E74AC1594475C73AB02AA8F@uxcn10-tdc05.UoA.auckland.ac.nz>, <A7A39FBA-E705-433C-98DD-1FB29AF4E865@inria.fr>
In-Reply-To: <A7A39FBA-E705-433C-98DD-1FB29AF4E865@inria.fr>
Accept-Language: en-NZ, en-GB, en-US
Content-Language: en-NZ
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
x-originating-ip: [130.216.158.4]
Content-Type: text/plain; charset="Windows-1252"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Archived-At: <http://mailarchive.ietf.org/arch/msg/tls/_eaHTnLeSJ_LQfC4qG3A94tJ7t8>
Cc: "<tls@ietf.org>" <tls@ietf.org>
Subject: Re: [TLS] Another IRINA bug in TLS
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sun, 24 May 2015 09:55:34 -0000

Karthikeyan Bhargavan <karthikeyan.bhargavan@inria.fr>; writes:

>The confusion between DSA and PKCS#3 has other unexpected consequences. As we
>describe in 3.5 of our Imperfect Forward Secrecy paper, some server
>implementations take a DSA group (p,q,g) and, when fitting it to TLS, confuse
>the “q” with the generator “g”. This bug leads to a rather nasty attack.
>
>(Yeah, you’d probably want to add this to the WTF category.)

It's a WTF, but it's the IETF's, not the implementers':

/* [...]

   For peculiar historical reasons (copying errors and the use of obsolete
   drafts as reference material) the X9.42 interpretation used in PKIX 
   reverses the second two parameters from FIPS 186 (so it uses p, g, q 
   instead of p, q, g), so when we read/write the parameter information we 
   have to switch the order in which we read the values if the algorithm 
   isn't DSA */

Peter.