Re: [TLS] Collisions (Re: Nico's suggestions - Re: Consensus Call:

[Marsh Ray <[e-mail]>]

On 5/13/2010 2:15 AM, Yoav Nir wrote:
> I kind of fail to see where the discussion shifted. In fact we have
> NOT determined that *malicious* collision resistance is a concern.

I have determined that I am concerned about malicious collisions, until
I get a comfortable feeling that they're not a problem. It's certainly
not anyone else's job to make me feel a certain way, but I hope you
don't mind if I ask a bunch of questions.

We should also keep in mind that the extension only addresses two types
of cached data at this time, but could possibly later include more. If
security analysis needs to based on the particulars of a given cached
item type that should get written down somewhere in the draft.

> A client connects to a server and caches the credentials. Next time
> it connects to the *same* server,

The client may intend to connect to the same server, but we can't assume
it actually *is* connecting to the same server at this point in the
handshake. Proving that it actually is the same server is the #1 goal of
the handshake, and can't be considered a success until the Finished
message is checked.

> it shows an extension that proves
> knowledge of the credentials.

How does it do that?

The extension is sent in-the-clear so it's not a shared secret. I don't
see any signing operation either.

Without collision resistance, attacker may have arranged for the client
to cache something different with the same hash. Client and server may
be using the same hash to talk about different things.

> Assuming the credentials haven't
> changed, the server can skip sending the credentials, but still has
> to prove ownership by signing something or by decrypting the
> pre-master secret. So what could an attacker do?

Are we discussing only the certificate_chain caching right now?

There's also the trusted_cas type and any defined in the future (if in
fact this is a general extensible facility).

- Marsh