Re: [TLS] Rethink TLS 1.3

[Nico Williams <[e-mail]>]

On Mon, Nov 24, 2014 at 11:27:12AM -0800, Brian Smith wrote:
>                 [...]. In particular, we should recognize that the
> "conservative" approach of making minimal changes to address
> individual issues has negative consequences. Further, the

Yes, and the session hash I-D takes that approach.

> renegotiation flaw, BEAST, CRIME, Triple Handshake, etc. all should be
> seen as evidence that the development model for TLS should shift to
> one that is likely to preempt unknown attacks, instead of one that
> reacts to attacks.

Well, yes, but I think we need to subject TLS 1.3 to the sort of
security analysis that is generally done for cryptographic algorithm
contests.

And the I-D and RFC really needs to include a security analysis where
conceivable attacks are described, with text explaining why the attack
does not work on TLS 1.3.  Appendix F is a bit light-weight at this
point.

We can easily provide this for all attacks that have worked in the past
against TLS and similar protocols.  Finding new attacks is the fun
(difficult) part.

> > Please stop claiming that providing so much control to an attacker
> > as something that is (or should be) normal, rather than considering
> > providing so much control to attackers as what it really is:
> > a huge and gaping vulnerability in Web-Browsers and in the
> > (lack of a) Web Security Model.
> 
> Attackers having that level of control is normal for people who build
> software for the web, which is a very large group of people in the TLS
> community. Ultimately, this means that adaptive chosen plaintext
> attacks and other negative consequences of the web security model are
> well within scope.

And should be.  Since otherwise the applicability of TLS would be quite
constrained, and it'd be quite difficult to ensure that all uses of TLS
are within those constraints.

To make TLS 1.3 useful it must be secure relative to adaptive chosen
plaintext attacks, and anyways, we can't fix the web security model at
this layer.

Nico
--