Re: [TLS] Curve25519 and TLS

[Watson Ladd <[e-mail]>]

On Fri, Jun 13, 2014 at 6:37 PM, Andy Lutomirski <[e-mail]> wrote:
> On 06/13/2014 02:30 PM, Watson Ladd wrote:
>> For TLS 1.3 we should ensure contributory behaviour is not required to
>> avoid these issues.
>
> What needs to change for this to be the case?  It would be even nicer if
> the result were provably correct in some reasonable model.

Hash the entire exchange into the generated key, so that a key made by
someone cheating is only shared with them. I still don't understand
why this isn't done already: it's needed for the finished message, so
nothing is saved by not doing it. This is what the triple handshake
fix is supposed to do, but it does a strange variant that reuses the
oddball finished message.

(And use a strong hash function: apparently the reason we haven't
finished fixing Triple Handshake is that some people want to use
SHA-1. On their heads be it!)

If the protocol is simple enough CryptoVerif can do the proofs with
some prodding: proving shouldn't really be the issue. Hashing helps
here by enabling the formation of a concept of "matching exchange",
and thus significantly constraining an attacker.

Sincerely,
Watson Ladd