[TLS] Symmetric cipher guidance in draft-bmoeller-tls-falsestart-01 (POODLE, BEAST)

Brian Smith <brian@briansmith.org> Tue, 23 December 2014 21:37 UTC

MIME-Version: 1.0
Date: Tue, 23 Dec 2014 13:37:35 -0800
Message-ID: <CAFewVt6QhBieA_Fks=szGLLR9u4NhaRVBEebOknHLg1_u9M7_g@mail.gmail.com>
From: Brian Smith <brian@briansmith.org>
To: "<tls@ietf.org>" <tls@ietf.org>
Content-Type: text/plain; charset="UTF-8"
Archived-At: http://mailarchive.ietf.org/arch/msg/tls/oC_OoLtn-tWuh_s9vjd9V-CVVYw
Subject: [TLS] Symmetric cipher guidance in draft-bmoeller-tls-falsestart-01 (POODLE, BEAST)
Precedence: list

draft-bmoeller-tls-falsestart-01 section-6.1 says:

   Also, various ciphers specified for use with TLS are known to have
   cryptographic weaknesses regardless of key length (none of the
   ciphers specified in [RFC4492] and [RFC5246] can be recommended for
   use with False Start).

I think it would be useful to think about, and note, why none of the
RFC4492/RFC5246 ciphers are acceptable for False Start. The case
against RC4 or weaker-than-AES CBC-mode ciphers is pretty clear, but
the case against >=128-bit CBC-mode ciphers is less clear.

For example, does POODLE or BEAST really matter for False Start? If an
attacker tampered with the handshake, then the client's Finished
message will be wrong, and the server (probably) won't process any
application data that follows. Thus, it seems unlikely that POODLE is
a problem for False Start. Similarly, how could False Start help an
attacker succeed using the BEAST attack?

Is there something I'm overlooking?

Thanks,
Brian

[TLS] Symmetric cipher guidance in draft-bmoeller… Brian Smith