Re: [TLS] New drafts: adding input to the TLS master secret

Dean Anderson <dean@av8.com> Tue, 09 February 2010 00:27 UTC

Return-Path: <dean@av8.com>
X-Original-To: tls@core3.amsl.com
Delivered-To: tls@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 4DBD13A6E03 for <tls@core3.amsl.com>; Mon, 8 Feb 2010 16:27:26 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.187
X-Spam-Level:
X-Spam-Status: No, score=-2.187 tagged_above=-999 required=5 tests=[AWL=0.412, BAYES_00=-2.599]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id v9NqsAiSL3ws for <tls@core3.amsl.com>; Mon, 8 Feb 2010 16:27:25 -0800 (PST)
Received: from cirrus.av8.net (cirrus.av8.net [130.105.36.66]) by core3.amsl.com (Postfix) with ESMTP id 34B8A3A69A0 for <tls@ietf.org>; Mon, 8 Feb 2010 16:27:24 -0800 (PST)
Received: from citation2.av8.net (citation2.av8.net [130.105.12.10]) (authenticated bits=0) by cirrus.av8.net (8.12.11/8.12.11) with ESMTP id o190SRfU013920 (version=TLSv1/SSLv3 cipher=EDH-RSA-DES-CBC3-SHA bits=168 verify=NO); Mon, 8 Feb 2010 19:28:27 -0500
Date: Mon, 8 Feb 2010 19:28:26 -0500 (EST)
From: Dean Anderson <dean@av8.com>
X-X-Sender: dean@citation2.av8.net
To: Martin Rex <mrex@sap.com>
In-Reply-To: <201002082259.o18MxsB6017864@fs4113.wdf.sap.corp>
Message-ID: <Pine.LNX.4.44.1002081928010.17664-100000@citation2.av8.net>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Cc: paul.hoffman@vpnc.org, tls@ietf.org
Subject: Re: [TLS] New drafts: adding input to the TLS master secret
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/tls>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 09 Feb 2010 00:27:26 -0000

+5

		--Dean

On Mon, 8 Feb 2010, Martin Rex wrote:

> Eric Rescorla wrote:
> > 
> > At Mon, 8 Feb 2010 14:29:12 -0500 (EST),
> > Dean Anderson wrote:
> > > On Sat, 6 Feb 2010, Eric Rescorla wrote:
> > > The primary purpose (unique master_secrets) of these random numbers is
> > > unimportant.  If they are not truly random, they expose the
> > > pseudo-random sequence generator sequence. This is an unintended (but
> > > significant) consequence.
> > 
> > With any reasonable PRNG this is not a security concern.
> 
> You may be looking at the problem from the wrong angle.
> 
> If there is not enough entropy to seed your CPRNG, then it is
> possible to brute force the entire entropy range and check for matches
> with the leaked randomness to know about the "unleaked" randomness
> that goes into the client key exchange (or premaster secret for RSA).
> 
> 
> If you want to create keying material, then you must have sufficient
> entropy in order to prevent attackers from brute-forcing your entire
> keyspace -- something which is possible when the implementation
> (of the CPRNG an protocols using it) is fully known, and the only
> unknown is the entropy that seeds the PRNG.
> 
> 
> As soon as you have a strong enough seed of the CPRNG, there is no
> more need for this extension.
> 
> 
> So the situation is that either you have a problem, then
> this extension is not going to help you (actually, if you leak
> PRNG state through Hello Randoms or the data in this extension,
> it gets _much_ worse), or you do not have a problem, then this
> extension becomes completely unnecessary.
> 
> 
> A TLS peer that does not have good sources of randomness (which are
> necessary to seed a good CPRNG), then that TLS peer should not
> leak any of that state by publishing randomness from that CPRNG,
> neither through Hello.Random, nor through an extension like the
> one proposed.  In those cases, it might be more sensible to use
> a simple counter for the Hello.Random and fill in the gmt_time
> correctly.
> 
> 
> -Martin
> 
> 

-- 
Av8 Internet   Prepared to pay a premium for better service?
www.av8.net         faster, more reliable, better service
617 256 5494