Re: [TLS] Data volume limits
Eric Rescorla <ekr@rtfm.com> Tue, 15 December 2015 23:48 UTC
Return-Path: <ekr@rtfm.com>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D24151B2CF8 for <tls@ietfa.amsl.com>; Tue, 15 Dec 2015 15:48:54 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.277
X-Spam-Level:
X-Spam-Status: No, score=-1.277 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001] autolearn=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Th0Sa7PTp0Xy for <tls@ietfa.amsl.com>; Tue, 15 Dec 2015 15:48:53 -0800 (PST)
Received: from mail-qk0-x233.google.com (mail-qk0-x233.google.com [IPv6:2607:f8b0:400d:c09::233]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8660C1B2CF4 for <tls@ietf.org>; Tue, 15 Dec 2015 15:48:50 -0800 (PST)
Received: by mail-qk0-x233.google.com with SMTP id t125so39753973qkh.3 for <tls@ietf.org>; Tue, 15 Dec 2015 15:48:50 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-type; bh=fbklgIgdvuQG+fr9TABTa+18JwSxhaFNLvVvCCFuL60=; b=Tf9+viJZ9t2YNJztYC3ou3DAIzTMx7FnbcoUPnuzWPolh3VvcphN2Uxq80BDMdsweT heSLQeWFea0CwM8gJvzeRWSmQdH973EFgWEi8hInmZF3uukc28Flot70cwK9g6pQn2My ZNBUnFhVLlWtJwbApVFldTHrSlO68/WQUS7+jOTCirlXZr9RKGYFa6mY1WnsXlEQ/FOe GJvHjBUzV1k/woFZONjhm1meP7W9HE4t7fdsaLCr1eymgrthwL1iVg06jhV/N2+cZ4Ol AXmTECirDGm5NEBPhXcndWP4qkdn9rDE79/LOT3QILbhl4trAih+EENxwpcUsOvDAp+O UMYQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc:content-type; bh=fbklgIgdvuQG+fr9TABTa+18JwSxhaFNLvVvCCFuL60=; b=KBTyYkq0pijqOSYJY8JUZtS5THu3hB9372J2hbjTuRGVkyjlyg8EnVFMS2hxWcMzfG OlGGy+U9UCKt6eqDl7sVM8z1HoOeRnz1s4ULE1KlN9QIca8qtYHuPorQ6b19WU6RjXWI jJYw8c4RpkmI7zMJIFCpvp7isBuJopIW4JGP2Ml237TnNPN2Gg1lc5tceHAw97CSf6ge SN3H3ItdNT+6dmL+OCyIoK3BlRm1sJ+XMpQs5VZ/Kc4zB4OVBzkkHWvNvTCsXtq9k4VZ PhvjHDekXXa6NDAq+DrJD83xw2pn+FulxPclWfa5FMzASZNCQGRiy4/hRF/ml44JLoYc 5n3Q==
X-Gm-Message-State: ALoCoQmI80yLYNf6oQmgZLClgKkVV9GIQlnlACXDsctjQMMBafCuV2XxYzeXgUQQ3UN3xxoF81rd3pMLjazO3otDtBhwxwcOjA==
X-Received: by 10.13.193.4 with SMTP id c4mr10623080ywd.192.1450223329682; Tue, 15 Dec 2015 15:48:49 -0800 (PST)
MIME-Version: 1.0
Received: by 10.13.249.197 with HTTP; Tue, 15 Dec 2015 15:48:10 -0800 (PST)
In-Reply-To: <6674a4ec51fe4e158929bf429260d6ea@XCH-RTP-006.cisco.com>
References: <CABcZeBNR76DqPo0Mukf5L2G-WBSC+RCZKhVGqBZq=tJYfEHLUg@mail.gmail.com> <e007baa2f53249d49917e6023e578bc0@XCH-RTP-006.cisco.com> <CACsn0ckSo-affRmsTZaodCJZsFisPygnhk9=OZuV0_9SVMbUxQ@mail.gmail.com> <6674a4ec51fe4e158929bf429260d6ea@XCH-RTP-006.cisco.com>
From: Eric Rescorla <ekr@rtfm.com>
Date: Tue, 15 Dec 2015 15:48:10 -0800
Message-ID: <CABcZeBNSHGGwM41c9QS0G-pnsEkuyA-q6FMhMgv2NQBDmwWwqA@mail.gmail.com>
To: "Scott Fluhrer (sfluhrer)" <sfluhrer@cisco.com>
Content-Type: multipart/alternative; boundary="001a114caa9e695bbf0526f86e61"
Archived-At: <http://mailarchive.ietf.org/arch/msg/tls/auWGxJ-J2K4MLToN66bxNOqGEm8>
Cc: "tls@ietf.org" <tls@ietf.org>
Subject: Re: [TLS] Data volume limits
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 15 Dec 2015 23:48:55 -0000
On Tue, Dec 15, 2015 at 3:08 PM, Scott Fluhrer (sfluhrer) < sfluhrer@cisco.com> wrote: > > > > -----Original Message----- > > From: Watson Ladd [mailto:watsonbladd@gmail.com] > > Sent: Tuesday, December 15, 2015 5:38 PM > > To: Scott Fluhrer (sfluhrer) > > Cc: Eric Rescorla; tls@ietf.org > > Subject: Re: [TLS] Data volume limits > > > > On Tue, Dec 15, 2015 at 5:01 PM, Scott Fluhrer (sfluhrer) > > <sfluhrer@cisco.com> wrote: > > > Might I enquire about the cryptographical reason behind such a limit? > > > > > > > > > > > > Is this the limit on the size of a single record? GCM does have a > > > limit approximately there on the size of a single plaintext it can > > > encrypt. For TLS, it encrypts a record as a single plaintext, and so > > > this would apply to extremely huge records. > > > > The issue is the bounds in Iwata-Ohashai-Minematsu's paper, which show a > > quadratic confidentiality loss after a total volume sent. This is an > exploitable > > issue. > > Actually, the main result of that paper was that GCM with nonces other > than 96 bits were less secure than previous thought (or, rather, that the > previous proofs were wrong, and what they can prove is considerably worse; > whether their proof is tight is an open question). They address 96 bit > nonces as well, however the results they get are effectively unchanged from > the original GCM paper. I had thought that TLS used 96 bit nonces > (constructed from 32 bit salt and a 64 bit counter); TLS 1.3 uses a 96-bit nonce constructed by masking the counter with a random value. were the security guarantees from the original paper too weak? If not, > what has changed? > > The quadratic behavior in the security proofs are there for just about any > block cipher mode, and is the reason why you want to stay well below the > birthday bound. The birthday bound here is 2^{64}, right? -Ekr > However, that's as true for (say) CBC mode as it is for GCM > >
- Re: [TLS] Data volume limits Watson Ladd
- [TLS] Data volume limits Eric Rescorla
- Re: [TLS] Data volume limits Eric Rescorla
- Re: [TLS] Data volume limits Watson Ladd
- Re: [TLS] Data volume limits Eric Rescorla
- Re: [TLS] Data volume limits Dave Garrett
- Re: [TLS] Data volume limits Benjamin Beurdouche
- Re: [TLS] Data volume limits Scott Fluhrer (sfluhrer)
- Re: [TLS] Data volume limits Eric Rescorla
- Re: [TLS] Data volume limits Russ Housley
- Re: [TLS] Data volume limits Watson Ladd
- Re: [TLS] Data volume limits Hanno Böck
- Re: [TLS] Data volume limits Scott Fluhrer (sfluhrer)
- Re: [TLS] Data volume limits Watson Ladd
- Re: [TLS] Data volume limits Eric Rescorla
- Re: [TLS] Data volume limits Brian Smith
- Re: [TLS] Data volume limits Henrick Hellström
- Re: [TLS] Data volume limits Watson Ladd
- Re: [TLS] Data volume limits Andrey Jivsov
- Re: [TLS] Data volume limits Scott Fluhrer (sfluhrer)
- Re: [TLS] Data volume limits Henrick Hellström
- Re: [TLS] Data volume limits Brian Smith
- Re: [TLS] Data volume limits Martin Thomson
- Re: [TLS] Data volume limits Martin Thomson
- Re: [TLS] Data volume limits Eric Rescorla
- Re: [TLS] Data volume limits Watson Ladd
- Re: [TLS] Data volume limits Dave Garrett
- Re: [TLS] Data volume limits Stephen Farrell
- Re: [TLS] Data volume limits Dave Garrett
- Re: [TLS] Data volume limits Martin Thomson
- Re: [TLS] Data volume limits Bill Frantz
- Re: [TLS] Data volume limits Eric Rescorla
- Re: [TLS] Data volume limits Martin Thomson
- Re: [TLS] Data volume limits Dave Garrett
- Re: [TLS] Data volume limits Andrey Jivsov
- Re: [TLS] Data volume limits Ryan Carboni
- Re: [TLS] Data volume limits Paterson, Kenny
- Re: [TLS] Data volume limits Simon Josefsson
- Re: [TLS] Data volume limits Eric Rescorla
- Re: [TLS] Data volume limits Henrick Hellström
- Re: [TLS] Data volume limits Watson Ladd
- Re: [TLS] Data volume limits Watson Ladd
- Re: [TLS] Data volume limits Dang, Quynh
- Re: [TLS] Data volume limits Blumenthal, Uri - 0553 - MITLL
- Re: [TLS] Data volume limits Watson Ladd
- Re: [TLS] Data volume limits Blumenthal, Uri - 0553 - MITLL
- Re: [TLS] Data volume limits Watson Ladd
- Re: [TLS] Data volume limits Blumenthal, Uri - 0553 - MITLL
- Re: [TLS] Data volume limits Watson Ladd
- Re: [TLS] Data volume limits Brian Smith
- Re: [TLS] Data volume limits Watson Ladd
- Re: [TLS] Data volume limits Brian Smith
- Re: [TLS] Data volume limits Watson Ladd
- Re: [TLS] Data volume limits Nikos Mavrogiannopoulos
- Re: [TLS] Data volume limits Yoav Nir
- Re: [TLS] Data volume limits Dang, Quynh
- Re: [TLS] Data volume limits Hubert Kario
- Re: [TLS] Data volume limits Eric Rescorla
- Re: [TLS] Data volume limits Florian Weimer
- Re: [TLS] Data volume limits Eric Rescorla
- Re: [TLS] Data volume limits Florian Weimer
- Re: [TLS] Data volume limits Eric Rescorla
- Re: [TLS] Data volume limits Blumenthal, Uri - 0553 - MITLL
- Re: [TLS] Data volume limits Eric Rescorla
- Re: [TLS] Data volume limits Blumenthal, Uri - 0553 - MITLL
- Re: [TLS] Data volume limits Ilari Liusvaara
- Re: [TLS] Data volume limits Salz, Rich
- Re: [TLS] Data volume limits Blumenthal, Uri - 0553 - MITLL
- Re: [TLS] Data volume limits Dang, Quynh
- Re: [TLS] Data volume limits Brian Smith
- Re: [TLS] Data volume limits Eric Rescorla
- Re: [TLS] Data volume limits Dave Garrett
- Re: [TLS] Data volume limits Eric Rescorla
- Re: [TLS] Data volume limits Blumenthal, Uri - 0553 - MITLL
- Re: [TLS] Data volume limits Aaron Zauner
- Re: [TLS] Data volume limits Aaron Zauner
- Re: [TLS] Data volume limits Ilari Liusvaara
- Re: [TLS] Data volume limits Samuel Neves
- Re: [TLS] Data volume limits Henrick Wibell Hellström
- Re: [TLS] Data volume limits Ilari Liusvaara
- Re: [TLS] Data volume limits Aaron Zauner
- Re: [TLS] Data volume limits sneves
- Re: [TLS] Data volume limits Aaron Zauner
- Re: [TLS] Data volume limits James Cloos
- Re: [TLS] Data volume limits Samuel Neves
- Re: [TLS] Data volume limits Eric Rescorla
- Re: [TLS] Data volume limits Ilari Liusvaara
- Re: [TLS] Data volume limits James Cloos
- Re: [TLS] Data volume limits Watson Ladd
- Re: [TLS] Data volume limits Eric Rescorla
- Re: [TLS] Data volume limits James Cloos
- Re: [TLS] Data volume limits Hubert Kario
- Re: [TLS] Data volume limits Florian Weimer
- Re: [TLS] Data volume limits Florian Weimer
- Re: [TLS] Data volume limits Hubert Kario
- Re: [TLS] Data volume limits Florian Weimer
- Re: [TLS] Data volume limits Benjamin Kaduk
- Re: [TLS] Data volume limits Florian Weimer