Re: [TLS] What would make TLS cryptographically better for TLS 1.3

[Nico Williams <[e-mail]>]

On Fri, Nov 01, 2013 at 04:34:24PM -0700, Robert Ransom wrote:
> The server should be allowed to send up to 32 bytes of nonce.  Some
> servers will want to conceal the lifetime of their keypair by
> generating nonces using a counter encrypted or hashed with a secret,
> using the cheapest encryption or hash function available; this may be
> TEA, AES, SHA-256, or something else, depending on the hardware.  Some
> servers will want to use a fast RNG to generate nonces.  32 bytes
> should be enough to prevent even a random (or hash-derived) nonce from
> repeating; anything less than that may not be enough for some servers.

The point of smaller/fewer nonces is two-fold:

 - if anyone was using 32 bytes of Dual_EC DRBG output before and it
   went unnoticed because, hey, that's what it's there fore, well, now
   it may be more noticeable if they do that sort of thing and spread
   those magic 32 bytes over several nonces

   Yes, this is fighting yesterday's war.  But anyways.

 - less subliminal channel bandwidth (same thing)

   Subliminal channels are very difficult to eliminate.  Merely reducing
   their bandwidth ought to help.  If, for example, there's only a 16
   bytes total of nonces in the handshakes (8 bytes for each of the
   client and server), and the cipher+mode in use doesn't need random
   IVs, then TLS connections would have no subliminal channels
   post-handshake, and hopefully the channel in the handshakes is very
   small (there's still bogus extensions and such to consider, but those
   at least can stand out).

   Worth it?  I think so.

Nico
--