Re: [TLS] ops review of draft-ietf-tls-sslv3-diediedie

[Martin Thomson <[e-mail]>]

On 22 March 2015 at 06:01, Fred Baker (fred) <[e-mail]> wrote:
>> On Mar 22, 2015, at 7:43 AM, Stephen Farrell <[e-mail]> wrote:
>> On 22/03/15 06:29, Fred Baker (fred) wrote:
>>> One implication that the document doesn’t bring out directly, but
>>> which follows from the discussion of the attacks, is that any key or
>>> certificate that has been exchanged using SSL may have been
>>> compromised via a man-in-the-middle attack, and is therefore suspect.
>>> Such certificates and keys should be replaced
>>
>> I don't think that is the case, as SSL's imperfections bad as they
>> are, don't expose long-term (private) keying material. But it is
>> worth checking. Short-term keys will naturally be replaced without
>> any operator action in any SSL->TLS transition I think. And any
>> trust anchors that were accepted via self-signed certificates will
>> be as good or bad as ever and are probably best left alone if one
>> isn't changing s/w but just a config.
>
> You may ell be correct. I also noted, after having sent the email, that it is fairly probable that a different crypto algorithm might be selected as a result of the transition, which would entail obtaining relevant keys and certificates anyway.


Hi Fred,

Thanks for the writeup.

With respect to this issue, I just did some double-checking and the
treatment of certificates and the associated long-term keying material
is identical between SSL3 and TLS 1.1.  Some changes were made with
respect to signatures in TLS 1.2, but those probably won't materially
affect the analysis.

So, absent new attacks being found, my analysis is that we're OK with
respect to long-term keying material.  If someone does find an attack,
then we'll be retiring TLS 1.0 and 1.1 in a panic.

--Martin