Re: [TLS] Rizzo claims implementation attach, should be interesting

[Eric Rescorla <[e-mail]>]

On Fri, Sep 23, 2011 at 1:02 PM, Martin Rex <[e-mail]> wrote:
>  Again, you're missing the point.  The IVs in SSLv3&TLSv1.0 _are_
> random in exactly the fashion that CBC is designed to work.
> The problem isn't the randomness, but that the first IV of
> each new SSL record is _predictable_ by the attacker.
>
> For TLS, processing is normally done in quantities of
> SSL records, so creating a single new random IV for the
> start of the SSL record is sufficient.
>
> Other environments might be (ab-)using CBC in a directly-streaming
> (i.e. data is sent as soon as the cipher block is full), and
> such a usage scenario would need a random IV for EVERY cipher block
> (i.e. it must not use CBC at all).

Note that RFC4346 specifically prohibits that behavior in S 6.2.3.2:

   Note: With block ciphers in CBC mode (Cipher Block Chaining), it is
         critical that the entire plaintext of the record be known
         before any ciphertext is transmitted.  Otherwise, it is
         possible for the attacker to mount the attack described in
         [CBCATT].

This restriction was added precisely to counter the attack you describe.

-Ekr