Re: [TLS] Upload of draft-pironti-tls-length-hiding-00

[[e-mail] (Martin Rex)]

Alfredo Pironti wrote:
> 
> I uploaded a draft that explains how to correctly use extra padding in
> TLS to effectively hide the plaintext length. The draft proposes an
> extension where length-hiding padding can be used with any cipher.
> 
> Furthermore, by including the pad in the MAC computation, the proposed
> extension fixes the notorious padding oracle attacks on TLS block
> ciphers.
> 
> The proposed extension and length-hiding mechanism are implemented in
> GnuTLS 3.1.7.
> 
> I look forward to your comments and suggestions!


Since TLS implementations will likely need to support interop
for the original ciphersuites and GenericBlockCipher, GenericStreamCipher
and GenericAEADCipher for many years to come, I would personally prefer
to keep the PDU changes to a minimum.

Is there any specific benefit or necessity for the padding to be inserted
before the plaintext, rather than directly trailing the plaintext?

-Martin