Re: [TLS] TLS1.3

[Nikos Mavrogiannopoulos <[e-mail]>]

On Mon, Feb 11, 2013 at 10:26 AM, Paterson, Kenny
<[e-mail]> wrote:

>>  The reality of TLS though is that there are many MACs in everyday use that are not secure (based on hashes of 80bits or even 64 bits). These are currently protected from attack by being behind strong (112bit or 128 bit) crypt.
> The "usual" MAC algorithms for TLS are HMAC-MD5, HMAC-SHA-1 and HMAC-SHA-256 (HMAC-SHA-384 is also a possibility). These all have MAC tags of at least 128 bits.

Indeed but note that today we have key recovery attacks on HMAC-MD4
[1,0]. Partial key recovery attacks exist on HMAC-MD5, too. It may be
long until such an attack applies to an encrypt-then-authenticate
setup, but could someone rule that possibility out? The current
authenticate-then-encrypt mode would most likely prevent such attacks.
The encrypt-then-authenticate modes would provide any adversary with
the MACed data and the MAC in plain.

It seems like a tradeoff between concealment and integrity.

Personally, I do believe that any fix to a protocol with such
deployment should be targeted at the problem in question, unless there
are serious reasons to believe that the old mechanism is beyond
repair. I do think we are not in that case yet and a mechanism to make
the pad part of the MAC as I proposed in an earlier e-mail is
sufficient.
However, I also believe any solution is better than no solution at
all, and I do think that this WG should decide on a document to update
RFC5246, which either fixes the issue or replaces the CBC
ciphersuites.

regards,
Nikos

[0]. Contini, Scott, and Yiqun Yin. "Forgery and partial key-recovery
attacks on HMAC and NMAC using hash collisions." Advances in
Cryptology–ASIACRYPT 2006 (2006): 37-53.

[1]. Fouque, Pierre-Alain, Gaëtan Leurent, and Phong Nguyen. "Full
key-recovery attacks on HMAC/NMAC-MD4 and NMAC-MD5." Advances in
Cryptology-CRYPTO 2007 (2007): 13-30.