Re: [TLS] TLS1.3

[Peter Gutmann <[e-mail]>]

Nikos Mavrogiannopoulos <[e-mail]> writes:

>However, the switch from MAC-then-Encrypt to Encrypt-then-MAC mode of
>operation is a radical move that does not affect only the CBC ciphers (e.g.
>RC4-SHA1 is also MAC-then-Encrypt).

It's actually pretty trivial.  Just to provide a data point on the effects of
this change, I've done a preliminary implementation and found that it's about
30 minutes work to add support for the MAC outside the encryption (I just
change the position of one function call and tweak a few things here and
there).  In addition the net change in code is so significant (due to removing
the masses of gunk I have in there to deal with side-channel attacks) that
I've created a separate function unwrapPacketTLSMAC() that's a tiny fraction
of the size and complexity of the original unwrapPacketSSL() and its
associated side-channel functions.  I estimate that, if I were to remove all
the legacy code, there'd be a net increase of -500 to -1000 lines of code from
adding encrypt-then-MAC, as well as taking a whole pile of potentially error-
prone cruft out of the code path.  As Martin has pointed out, this is such a
no-brainer it could have been made years ago with TLS 1.1's explicit IV.

If anyone wants to do some interop testing, let me know.  Currently I just
hardcode in e-then-M via a compile option for testing purposes, I haven't done
the extension-negotiation bit yet, although that should be pretty trivial in
any case.

Peter.