IETF Logo Mail Archive

Re: [TLS] The case for a single stream of data

Kyle Rose <krose@krose.org> Sat, 06 May 2017 13:43 UTC

Return-Path: <krose@krose.org>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 84BA1127337 for <tls@ietfa.amsl.com>; Sat, 6 May 2017 06:43:59 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.3
X-Spam-Level:
X-Spam-Status: No, score=-1.3 tagged_above=-999 required=5 tests=[BAYES_05=-0.5, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=krose.org
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4W5rwiTqGWUw for <tls@ietfa.amsl.com>; Sat, 6 May 2017 06:43:57 -0700 (PDT)
Received: from mail-qk0-x232.google.com (mail-qk0-x232.google.com [IPv6:2607:f8b0:400d:c09::232]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C359E127076 for <tls@ietf.org>; Sat, 6 May 2017 06:43:56 -0700 (PDT)
Received: by mail-qk0-x232.google.com with SMTP id n4so24643141qkc.0 for <tls@ietf.org>; Sat, 06 May 2017 06:43:56 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=krose.org; s=google; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=4YXBpb7OhR7mP+9XM73ZiGpdJUWiBDmrwX5uaiVQFMw=; b=PX9nMQ4ioizsvbxhmXZgoEZbls5ZJ1wrYPa7uyUWmQAEHA6NPLM70YwW2I4aziOh1a 7yj9FTglQbDTOiJRtriDah5i+hVdTUqYRDUTOTH1lLqsaGINKAn9GmEPcbnFmtgFisM9 k4y0pYF0RYfpErzDR9+8oxJwcVyN8inzcChwI=
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=4YXBpb7OhR7mP+9XM73ZiGpdJUWiBDmrwX5uaiVQFMw=; b=C1g9lqIz9Po34yoDav48msaIeMi3PTqCrqpm+0yWPSK1Xk+hZ0k6IWspCW9axsBS3y 6yMeO35AjsqwdhP9xybCRlwXwa1r95RmRzUyArn63P2DeEL53cG1VsYrf6AX/0omkeDQ cVRVfZp3WtiZAnMft+zJa25d5SVw31dJ8Prn+znOAJfVBODPrThjU2bfg5NFkOYp2P7V uTfTNfC632lUiQ3LJAHmw3mAK0F1N3ZXzIvH8cjLgeuYf/+6B+rseTZNfafxHVgJrE4+ g5dLhxaYWoXTPmhQl37RDsk4LZrME4SOuye8cR1eyfkXcEoDbQT8fmkA/EduEv9HnxBj WMIA==
X-Gm-Message-State: AODbwcA+eRw3N4SSjvaGgTp7L+WYdvmvveZEfM3328WTI2eQkQJIYitb v07VzzhHYiAUsoCDs28SaVGZO5poYw==
X-Received: by 10.55.142.70 with SMTP id q67mr1719765qkd.247.1494078236015; Sat, 06 May 2017 06:43:56 -0700 (PDT)
MIME-Version: 1.0
Received: by 10.55.80.65 with HTTP; Sat, 6 May 2017 06:43:55 -0700 (PDT)
X-Originating-IP: [2001:470:1f07:121:802e:2aff:fea9:7bd]
In-Reply-To: <879211b6670148a19b816018664324f2@usma1ex-dag1mb1.msg.corp.akamai.com>
References: <CAAF6GDfm=voTt_=JrdGtiaYby1JG8ySU2s6myjjpHKeGvi0bMg@mail.gmail.com> <879211b6670148a19b816018664324f2@usma1ex-dag1mb1.msg.corp.akamai.com>
From: Kyle Rose <krose@krose.org>
Date: Sat, 06 May 2017 09:43:55 -0400
Message-ID: <CAJU8_nXxNrSj4L+Ab+ENOgWaVhmn6Lt5eRUQOtPFfBCYqTOJeA@mail.gmail.com>
To: "Salz, Rich" <rsalz@akamai.com>
Cc: Colm MacCárthaigh <colm@allcosts.net>, "tls@ietf.org" <tls@ietf.org>
Content-Type: multipart/alternative; boundary="94eb2c083c8c868314054edb329f"
Archived-At: <https://mailarchive.ietf.org/arch/msg/tls/pfHiwEsqkp8dk0kgt8HYIVOijDA>
Subject: Re: [TLS] The case for a single stream of data
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sat, 06 May 2017 13:43:59 -0000

On Sat, May 6, 2017 at 8:22 AM, Salz, Rich <rsalz@akamai.com> wrote:

>
> What about when **part** of a request is in the 0RTT part, and the rest
> of it isn’t?  I believe this will happen often for H2 initial setup.
> Imagine the “fun” when initial connection data, such as login cookies, is
> replayed in other contexts and eventually decrypted?
>

I asked this question a while back, and didn't get a satisfying answer: if
an on-path attacker replaces the early data with a replay from an earlier
connection, does the server eventually figure this out once the handshake
is complete, or is this mix-and-match impossible for the server to detect?
It would be nice if a security property of early data is that a replay
attack is eventually detected, because at least then you'll know you're
under attack.

Kyle

v2.23.0 | Report a Bug | By Email