Re: [TLS] Rethink TLS 1.3

[Hubert Kario <[e-mail]>]

On Monday 24 November 2014 09:35:20 Watson Ladd wrote:
> On Mon, Nov 24, 2014 at 8:56 AM, Martin Rex <[e-mail]> wrote:
> > Nico Williams wrote:
> >> Henrick Hellström wrote:
> >>> Yes, but the point I am trying to make, is that if the implied goal
> >>> is to make TLS resilient even against BEAST/CRIME style attacks, the
> >>> threat model should be defined accordingly. It makes little sense to
> >>> ask for cryptographic review of the protocol, if it is inherently
> >>> unclear exactly what kind of threats the protocol is designed to
> >>> withstand.
> >> 
> >> BEAST/CRIME are dramatic demonstrations of the capabilities of attackers
> >> in the Internet threat model.
> > 
> > Nope.  BEAST, CRIME and Poodle are pretty boring demonstrations of the
> > ridiculous insecurity of WebBrowsers in their default 
configuration.https://tcms.engineering.redhat.com/case/295339/
> 
> So it's possible to get my Paypal login cookie if I browse to a
> malicious site on a fully patched browser? Because that's what BEAST
> enabled. Are you saying it's fine that SSL v3.0 leaks one byte per
> connection? Because that's POODLE. All of this was known in 2004, and
> not fixed in TLS 1.2

are you suggesting that AEAD ciphers are vulnerable to them? based on what 
mechanism?

I mean, sure they are not mandatory or the only TLS 1.2 compatible ciphers, 
but there are there...

-- 
Regards,
Hubert Kario