Re: [TLS] Are the AEAD cipher suites a security trade-off win with TLS1.2?

Colm MacCárthaigh <colm@allcosts.net> Wed, 16 March 2016 18:43 UTC

MIME-Version: 1.0
In-Reply-To: <CAMfhd9Vc3pkP4kuAKusAXFrkEcRgkL84rtwjGoDuRVbQHXKbkw@mail.gmail.com>
References: <CAAF6GDekw3stfYGd1q+Zzde--g5M0h9ZTWrVLVJxEwp+frQTHQ@mail.gmail.com> <D30F5033.66E40%kenny.paterson@rhul.ac.uk> <CAMfhd9Vc3pkP4kuAKusAXFrkEcRgkL84rtwjGoDuRVbQHXKbkw@mail.gmail.com>
Date: Wed, 16 Mar 2016 14:42:57 -0400
Message-ID: <CAAF6GDf7eGg-hY1PESD1bhQaZiko39dUhB5KsT2=Q0Pf-rhyBw@mail.gmail.com>
From: Colm MacCárthaigh <colm@allcosts.net>
To: Adam Langley <agl@imperialviolet.org>
Content-Type: multipart/alternative; boundary="001a114fa17cecf81a052e2ee178"
Archived-At: <http://mailarchive.ietf.org/arch/msg/tls/ppAelBNhiQqdJBcwesqjDG49QuQ>
Cc: "tls@ietf.org" <tls@ietf.org>
Subject: Re: [TLS] Are the AEAD cipher suites a security trade-off win with TLS1.2?
Precedence: list

On Wed, Mar 16, 2016 at 2:30 PM, Adam Langley <agl@imperialviolet.org>
wrote:

> On Wed, Mar 16, 2016 at 6:14 PM, Paterson, Kenny
> <Kenny.Paterson@rhul.ac.uk> wrote:
> >>provokes me to bring it up. Here's the crux of it; is it really a
> >>security win to recommend the AEAD cipher suites for TLS 1.2 users?
>
> I'm skeptical about the benefit of padding to 16 bytes. While it does
> increase the size classes in your Wikipedia example, Wikipedia pages
> trigger subresource loads, which also have a size and page-to-page
> navigation leaks more information. My takeaway from reading
> traffic-analysis papers over the years is that countermeasures are
> surprisingly difficult.
>

16-bytes is small, I wish it were much bigger, but it may elevate things to
where you even need to form a sub resource attack and increases the size of
the graph/fingerprint that you need to maintain to form the sub-resource
attack. I doubt it would thwart a large actor for very long, but it would
help against smaller ones and I'm guessing that it might block some
specific attacks like the autocompletion one mentioned in the paper.

-- 
Colm

[TLS] Are the AEAD cipher suites a security trade… Colm MacCárthaigh
Re: [TLS] Are the AEAD cipher suites a security t… Tom Ritter
Re: [TLS] Are the AEAD cipher suites a security t… Colm MacCárthaigh
Re: [TLS] Are the AEAD cipher suites a security t… Alexandre Anzala-Yamajako
Re: [TLS] Are the AEAD cipher suites a security t… Paterson, Kenny
Re: [TLS] Are the AEAD cipher suites a security t… Adam Langley
Re: [TLS] Are the AEAD cipher suites a security t… Colm MacCárthaigh
Re: [TLS] Are the AEAD cipher suites a security t… Colm MacCárthaigh
Re: [TLS] Are the AEAD cipher suites a security t… Colm MacCárthaigh
Re: [TLS] Are the AEAD cipher suites a security t… Salz, Rich
Re: [TLS] Are the AEAD cipher suites a security t… Benjamin Beurdouche
Re: [TLS] Are the AEAD cipher suites a security t… Martin Rex
Re: [TLS] Are the AEAD cipher suites a security t… Martin Rex
Re: [TLS] Are the AEAD cipher suites a security t… Peter Gutmann
Re: [TLS] Are the AEAD cipher suites a security t… Harlan Lieberman-Berg
Re: [TLS] Are the AEAD cipher suites a security t… Eric Rescorla
Re: [TLS] Are the AEAD cipher suites a security t… Peter Gutmann