Re: [TLS] Changes to draft-ietf-tls-dtls-heartbeat resulting from IESG review

["Dan Harkins" <[e-mail]>]

On Mon, December 5, 2011 1:37 am, Nikos Mavrogiannopoulos wrote:
> On Mon, Dec 5, 2011 at 7:13 AM, Joe Salowey <[e-mail]> wrote:
>> Some changes were made to the document as part of IESG review.  The
>> revised document and diffs can be found here:
>> http://www.ietf.org/internet-drafts/draft-ietf-tls-dtls-heartbeat-04.txt
>> http://tools.ietf.org/rfcdiff?url2=draft-ietf-tls-dtls-heartbeat-04
>> One of the requested changes was to randomize to the data in the
>> heartbeat message to attempt to head of any issues occurring from weak
>> or flawed ciphers.   Since the change was relatively simple, the
>> document was modified even though modern ciphers should not have a
>> problem.  Flaws may be discovered in one of the many cipher suites in
>> the future.
>
> Are there any papers or cipher documentation discussing how using
> randomized data in a packet would solve possible future cipher flaws?

  Check out "Deterministic Authenticated Encryption"* by Rogaway and
Shrimpton. It defines a cipher mode for key-wrapping but the proof of
security (appendix C) is based on the notion of randomized data in the
packet-- i.e. that part of the data (the key) being wrapped is random.

  They also treat this new cipher mode as a general IV-based authenticated
encryption scheme that has the property of misuse-resistance (section 7).

  regards,

  Dan.

 * http://www.cs.ucdavis.edu/~rogaway/papers/keywrap.pdf