Re: [TLS] Signed messages should be prefixed with a NUL-terminated context string.

Eric Rescorla <ekr@rtfm.com> Wed, 24 December 2014 18:56 UTC

Return-Path: <ekr@rtfm.com>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4788E1A1A56 for <tls@ietfa.amsl.com>; Wed, 24 Dec 2014 10:56:37 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.977
X-Spam-Level:
X-Spam-Status: No, score=-1.977 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id BQmTolxXQsv8 for <tls@ietfa.amsl.com>; Wed, 24 Dec 2014 10:56:35 -0800 (PST)
Received: from mail-wg0-f48.google.com (mail-wg0-f48.google.com [74.125.82.48]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3D9ED1A1A3D for <tls@ietf.org>; Wed, 24 Dec 2014 10:56:35 -0800 (PST)
Received: by mail-wg0-f48.google.com with SMTP id y19so11825460wgg.7 for <tls@ietf.org>; Wed, 24 Dec 2014 10:56:34 -0800 (PST)
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc:content-type; bh=yPw568t3xvQAbCeubHfg2r7jVU1tYTjWZPVjsKrX8AU=; b=ZvjLfSh+QQ3/pgeXkKyd4PfKoK9RqiZd0tdqb7TPnlf+BVcBnCH3MEiLly6yDup030 5W0db8BoweDUMR1vDUxUXteTImbwrEcWmVTgXrN+jc9LUoN+sWVWairIHvMOZ7YbOd0P 5D6OMjXpufSzt7lzIhkpBApcivNsSw4zmesJzOS0lVUkdOQQvH0pkRD68Ag63mMIh3DJ Vldjr9YPKsm90e7IY7FRygog771jb0c84r9OhO0ikZEitPU2ehUWaTX0ow72ZJAIIq/k I+ZdMrQQPYab3VvevLbACPJ0QbE3/ltKULzstDlEUX1i+BJDA5FDzrV6f5nqHoiWLa+o MtVg==
X-Gm-Message-State: ALoCoQnB8ZUgVX7mqTLOm1GBKPVWfscPE1DmNu7WoNAKaSFm60YsN18X189XTHBsYoUnPpOuXZY7
X-Received: by 10.194.63.198 with SMTP id i6mr64762696wjs.90.1419447394025; Wed, 24 Dec 2014 10:56:34 -0800 (PST)
MIME-Version: 1.0
Received: by 10.27.130.34 with HTTP; Wed, 24 Dec 2014 10:55:53 -0800 (PST)
In-Reply-To: <20141224185031.GA4583@LK-Perkele-VII>
References: <CAMfhd9XgR-N6BZVLojfyf6E2+0fhYVHopp5FKALoup_GjTji5A@mail.gmail.com> <CABcZeBMmFWOoh6Av=eAaMi6AA1Kb7X41Efie-0PuRZWwPPVz_A@mail.gmail.com> <860778484.3559563.1416987612674.JavaMail.zimbra@redhat.com> <CABcZeBPHQGMNYU1QbG=oeuVZYG71BqVaJU9E9e2Kh+rEWq=RXA@mail.gmail.com> <CAL9PXLwrZCgDUqd8ugqhcpYEBwLOcQXSLg8Kx8fgCq6tzLvO4A@mail.gmail.com> <CABcZeBPY8Jrg_ou_=frs9O2-0nrfL+V-H-jBCxDgQ4Ora55kvQ@mail.gmail.com> <20141223143719.GB11149@LK-Perkele-VII> <CABcZeBOb9tL5UO94Qrdn7AuamkPvs=+7aU0EF78p3Lac=JEh9w@mail.gmail.com> <20141224185031.GA4583@LK-Perkele-VII>
From: Eric Rescorla <ekr@rtfm.com>
Date: Wed, 24 Dec 2014 10:55:53 -0800
Message-ID: <CABcZeBO2D+DBW+XAzNv9BgXqXzmy8GgwbX24iGZDYXN=aqZ9fg@mail.gmail.com>
To: Ilari Liusvaara <ilari.liusvaara@elisanet.fi>
Content-Type: multipart/alternative; boundary=047d7ba972b8b2da76050afad9f7
Archived-At: http://mailarchive.ietf.org/arch/msg/tls/bBdSMczsvfaUKV6keTEaW9qWDeA
Cc: "tls@ietf.org" <tls@ietf.org>
Subject: Re: [TLS] Signed messages should be prefixed with a NUL-terminated context string.
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 24 Dec 2014 18:56:37 -0000

On Wed, Dec 24, 2014 at 10:50 AM, Ilari Liusvaara <
ilari.liusvaara@elisanet.fi>; wrote:

> On Wed, Dec 24, 2014 at 10:21:58AM -0800, Eric Rescorla wrote:
> > On Tue, Dec 23, 2014 at 6:37 AM, Ilari Liusvaara <
> > ilari.liusvaara@elisanet.fi>; wrote:
> >
> > > On Mon, Dec 22, 2014 at 01:38:36PM -0800, Eric Rescorla wrote:
> > > > Adam updated his PR to sign the prefix concatenated with the
> handshake
> > > > hashes, which makes it easier to have a single hash context.
> > > >
> > > > https://github.com/tlswg/tls13-spec/pull/100
> > > >
> > > > I haven't seen any objections to this idea, so I'll merge this on
> > > Wednesday
> > > > unless I hear an objection before then.
> > > >
> > >
> > > Any reason not to fix the hash function per-ciphersuite, so servers
> > > and clients don't have to run multiple hashes in parrallel?
> > >
> >
> > The client and server may want to use different signature algorithms.
>
> I mean the hash in data to be signed (not the internal hash function in
> signature algortithm).
>
> That is, it would be digital signature of:
>
> - 32 padding bytes (or ClientRandom)
> - 32 padding bytes (or ServerRandom)
> - Context string
> - Ciphersuite ID (to provode domain separation)
> - handshake_hash(transcript)
>

So to be clear, you are proposing that we might (for instance) have
a signature with (say) SHA-1 over a handshake hash computed with
SHA-256?

-Ekr



> This PR lacks the domain separation and requires both sides to buffer
> handshake or run potentailly lots of hashes (instead of just running
> one they need to run anyway).