Re: [TLS] Renegotiation and TLSNotary

Ilari Liusvaara <ilari.liusvaara@elisanet.fi> Sun, 29 March 2015 11:33 UTC

Date: Sun, 29 Mar 2015 14:33:52 +0300
From: Ilari Liusvaara <ilari.liusvaara@elisanet.fi>
To: Sergio Demian Lerner <sergio@coinspect.com>
Message-ID: <20150329113352.GA25692@LK-Perkele-VII>
References: <CAEoH-p4F006Uu8Xr=+V08DMAA5_yo2v8_6x-u6Yd+OMmh=_ytg@mail.gmail.com> <55124CC3.80708@shiftleft.org> <CAEoH-p5AL02YkTxJ7Abz9zJ=fxcvcJvLrh1nuOWs6=yUBAhpfw@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Disposition: inline
In-Reply-To: <CAEoH-p5AL02YkTxJ7Abz9zJ=fxcvcJvLrh1nuOWs6=yUBAhpfw@mail.gmail.com>
User-Agent: Mutt/1.5.23 (2014-03-12)
Sender: Ilari Liusvaara <ilari.liusvaara@elisanet.fi>
Archived-At: <http://mailarchive.ietf.org/arch/msg/tls/aX4RMnJ1jRUHw0Ekr-AKz10MNk4>
Cc: tls@ietf.org
Subject: Re: [TLS] Renegotiation and TLSNotary
Precedence: list

On Sun, Mar 29, 2015 at 08:06:48AM -0300, Sergio Demian Lerner wrote:
> Yes, you're right that the MAC construction in GCM allows the key owner to
> find colissions. I was thinking that the auditing mode would be used in
> combination with an emulated AEAD mode, such as AES_CBC + HMAC.

Maybe I don't quite understand what this is about, but doing certain
things with partial key disclosure requires running two MACs. Perhaps
this is one of those[1]?

The issue there is that the main MAC key must be assumed to be the same
as encryption key, so one needs a second MAC that one can disclose key
for.

[1] The first such thing I ran into was escrow decryption, where one
needs an inner MAC to prevent tampering.

-Ilari

[TLS] Renegotiation and TLSNotary Sergio Demian Lerner
Re: [TLS] Renegotiation and TLSNotary Martin Thomson
Re: [TLS] Renegotiation and TLSNotary Mike Hamburg
Re: [TLS] Renegotiation and TLSNotary Watson Ladd
Re: [TLS] Renegotiation and TLSNotary Sergio Demian Lerner
Re: [TLS] Renegotiation and TLSNotary Ilari Liusvaara