Re: [TLS] RFC5487 PSK Key Exchange Algorithm with SHA-256/384. Premaster secret if ciphersuites negotiated for TLS V1.2?

[Fox Arcadia <[e-mail]>]

Hi Mr Pégourié

Thanks for your answer. It is very helpful.

But one security concern.
Tls is now used by GlobalPlatform Amd. B. (Basically SmartCards, UICCs and
Embedded Secure elements).
Please see http://www.globalplatform.org/specificationscard.asp.

Part of the PMS is zeroes and this fact is known by the attacker.

Now he can study the power consumption of the device when the PRF is
processing the zeroes and try to get some information about counter
measures implemented by the protocol for these devices.

These attacks are known as DFA/SPA.
Please see
http://www.springer.com/computer/security+and+cryptology/book/978-0-387-30857-9

In your opinion using a key partially known by the attacker could imply a
security threat?

Thanks for your help

Kind regards







On Sun, Oct 19, 2014 at 11:37 AM, Manuel Pégourié-Gonnard <[e-mail]>
wrote:

> Hi,
>
> Sorry for replying so late, I hope this reply is still useful.
>
> On 20/09/2014 09:51, Fox Arcadia wrote:
> >  Note 2: Using zeroes for "other_secret" effectively means that
> >       only the HMAC-SHA1 part (but not the HMAC-MD5 part) of the TLS PRF
> >       is used when constructing the master secret.  This was considered
> >       more elegant from an analytical viewpoint than, for instance,
> >       using the same key for both the HMAC-MD5 and HMAC-SHA1 parts.  See
> >       [KRAWCZYK <http://tools.ietf.org/html/rfc4279#ref-KRAWCZYK>] for
> > a more detailed rationale.
> >
> IMO, this is only a rationale for using the zeroes, not a normative part.
>
> > but if using a PRF defined in TLS V1.2, then HMAC-MD5 is not used but
> > the HMAC defined by the PRF.
> >
> > And, in that case, part of the used premaster is zeroes.
> >
> Yes, in that case part of the PMS is zeroes, and it's fed to the TLS PRF
> (using
> SHA256) as is, including the zeroes.
>
> At least, that's what we do in PolarSSL and we never had interop issues
> (tested
> regularly with OpenSSL and GnuTLS at least).
>
> > should we in that case reuse PSK for other_secret?
> >
> Nope.
>
> Manuel.
>