Re: [TLS] Clarifications and questions: TLS1.3 - Static RSA and AEAD

["Blumenthal, Uri - 0558 - MITLL" <[e-mail]>]

>>>If they don't have any source of randomness, they are going to
>>> have problems generating any keys, random nonces or IVs, period!
>> Keys: manufacturer can generate random key pairs for such devices
>> and burn them in.
>
>I caution against such a practice.......
>Pre-baked keys make the manufacturer responsible for not just the
>implementation, but the actual keys.
>..............

Conceptually, is it different from manufacturer seeding the PRNG on such
devices?

>This has represented - and still represents - the most significant
>practical point of attack in numerous real-world implementations (to
>give one notable high-profile example: the seed compromise in RSA
>SecurID®).
>
>I would strongly recommend device manufacturers not to generate keys.

It may be the only reasonable alternative for small-factor embedded
devices, the other alternative being very bad keys generated on such
devices locally. 

I think most of the bad SSH and TLS keys reported on the Internet are the
result of such approach being implemented.

"A good man knows his limitations" - this should apply to good devices
too. :)


See 
@InProceedings{weakkeys12,
  author = {Nadia Heninger and Zakir Durumeric and Eric Wustrow and J.
Alex Halderman},
  title = {Mining Your {P}s and {Q}s: {D}etection of Widespread Weak Keys
in Network Devices},
  booktitle = {Proceedings of the 21st {USENIX} Security Symposium},
  month = aug,
  year = 2012
}


>>IVs:  contrary to what some people tend to believe, IV does not
>> have to be random (or even unpredictable). Being unique is
>> sufficient in many cases, including AEAD.
>
>A note of caution here: as I recall, CBC mode's one of the famous
>problem cases where non-random IVs enable a chosen-ciphertext attack?

Essentially yes. But it is not just CBC mode, it's a combination of the
usage, cipher suite, etc. I.e., if the MAC was in a better place wrt.
Pad+Encrypt and all this, y'know...

I personally would rather drop CBC than RSA. :-)

>[Of course, no AEAD I'm aware of uses CBC mode, so I believe we're
>switching away from that in TLS 1.3 - but still, the point bears
>mention in case of later misunderstanding.]

Of course. :-0