IETF Logo Mail Archive

Re: [TLS] Security review of TLS1.3 0-RTT

Colm MacCárthaigh <colm@allcosts.net> Fri, 19 May 2017 22:06 UTC

Return-Path: <colm@allcosts.net>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 18233129AAA for <tls@ietfa.amsl.com>; Fri, 19 May 2017 15:06:49 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.599
X-Spam-Level:
X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=allcosts-net.20150623.gappssmtp.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0caBQGZxTlvo for <tls@ietfa.amsl.com>; Fri, 19 May 2017 15:06:47 -0700 (PDT)
Received: from mail-yw0-x22e.google.com (mail-yw0-x22e.google.com [IPv6:2607:f8b0:4002:c05::22e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 672991294C4 for <tls@ietf.org>; Fri, 19 May 2017 15:06:47 -0700 (PDT)
Received: by mail-yw0-x22e.google.com with SMTP id l14so40665344ywk.1 for <tls@ietf.org>; Fri, 19 May 2017 15:06:47 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=allcosts-net.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to; bh=sNveR7guMwKFj7hYi0otiwVnOt7V/BcqJE0INDGmcEo=; b=aQAkqN8hPlPWftqCp77bzQG9U5PCYX730xyD3Idq1hl3W9nEWj869kiwT/fScVB5xN 6EoMWz0p36tW38G358uSXl1e85dsTrfCFfQSPTFKl/p5PFlSeWvNg2y7dD202szkszAM +5DUxFwJpCswMcNkiSdyhrV3bQZT3H38y4DDpEVJ1sWknpmrVNFJ1xldfPGQjUvdeDaf FT3n5B6kuRJMKJXoab8Ik3yEQB12ZqY9PsKh1/9FZEuTkMYbZdDXHTWw22ztJsgWCFig 8o0Yn+D8BYFVDHbU10Bjd9md32B9ntDztmHVAtEPaUP4qV1pgLtuk68JBYjj5ZRwWRxN HMUA==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to; bh=sNveR7guMwKFj7hYi0otiwVnOt7V/BcqJE0INDGmcEo=; b=EaLxmg4isi+H4CHoMaHz/5LOQW/EJSJJnZKqhbpA3iBRjNDwXc9cpYV7SDlTB4AIIu JC63RIamBfixS1YbsstpoEOMLRSKhLz/4VkexVrD5L8EwJAuOTJ/u0ZG4yA8kh8p8DTR Rn2h/gkKOsV8h/SyGVlvbqy5EYpoH2DlfuKse+uhft1YvfmaHLB6q9P7HAmtc080k7r0 +WuOebiDaiBTCV3rwR8eQ5fFBJmpjDwOIW/K9E1feX5xUyJC8MuMMTj9VrIyoI4sa2v0 4CVhDtZ6vSof27Syg2hmol7c+tc5zHwycMNSCPWocJLI9biAYxJcqwYxcyUX7HsB6qIF 8qDg==
X-Gm-Message-State: AODbwcA66tg7fIuC9PM0vouol92bli1To507GIEoon+oHR+gck7jp9LF LQXodeDY2eL+3m0QgusnxYir/cTF6/+7MVA=
X-Received: by 10.13.237.134 with SMTP id w128mr9536866ywe.122.1495231605993; Fri, 19 May 2017 15:06:45 -0700 (PDT)
MIME-Version: 1.0
Received: by 10.129.57.67 with HTTP; Fri, 19 May 2017 15:06:45 -0700 (PDT)
In-Reply-To: <5513C0EF-3282-4B87-AF0B-3B07D1094B50@dukhovni.org>
References: <CAAF6GDcKZj9F-eKAeVj0Uw4aX_EgQ4DuJczL4=fsaFyG9Yjcgw@mail.gmail.com> <CABcZeBNcnW9zEPZ4mEje1_ejR3npNFz65rw-6qUPn7cQt1Nz9w@mail.gmail.com> <CAAF6GDe1_ih1aUShrzAHUuTzbLx6+0BdVexpGnq90RZsST8GvA@mail.gmail.com> <CABcZeBOX5NXuhgfap2S0naO9PFXv+K-+fZVPbgck6yciVnrYbQ@mail.gmail.com> <CABcZeBPuOupLTNKOtuCgOjYNdiuw571HM-pq1vNZz_8x-XX5mg@mail.gmail.com> <CABcZeBMqALJ10cU7FMUhv8k5Q=tw3yu1-5pdrKzOBM3=g5PHJw@mail.gmail.com> <20170519095316.GA30080@LK-Perkele-V2.elisa-laajakaista.fi> <CAAF6GDeuRMZx9MRynrxMp1fCvRS2jjr0vcqt0R89cJEkD6u=rQ@mail.gmail.com> <20170519184051.GA31741@LK-Perkele-V2.elisa-laajakaista.fi> <CAAF6GDcP3_+WOB1xsc7JecpCo2-MfeuHgkN7PVrUiLweeurv2g@mail.gmail.com> <CAF8qwaByGeGtap8gDB-p3n-0DMqEL9uJGJQ4EErfkq-SFcbHGQ@mail.gmail.com> <5513C0EF-3282-4B87-AF0B-3B07D1094B50@dukhovni.org>
From: Colm MacCárthaigh <colm@allcosts.net>
Date: Fri, 19 May 2017 15:06:45 -0700
Message-ID: <CAAF6GDeuugk1=tShjVyt8LMX+L2qKkgEM5AyyA5SMbLudkO=_A@mail.gmail.com>
To: TLS WG <tls@ietf.org>
Content-Type: multipart/alternative; boundary="94eb2c08853ebbb4af054fe7bcd5"
Archived-At: <https://mailarchive.ietf.org/arch/msg/tls/cNLz13cU3sfBBKSMVp4SIwRhrIE>
Subject: Re: [TLS] Security review of TLS1.3 0-RTT
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 19 May 2017 22:06:49 -0000

On Fri, May 19, 2017 at 1:58 PM, Viktor Dukhovni <ietf-dane@dukhovni.org>
wrote:
>
> +1.  The additive obfuscation leaks nothing that is not already leaked
> just by sending the tickets.
>

You're both right, that does work out. I was thinking my balanced equations
stupidly and solving for x while forgetting that t1' is secret.

-- 
Colm

v2.23.0 | Report a Bug | By Email