Re: [TLS] [Cfrg] 3DES diediedie

"Stanislav V. Smyshlyaev" <smyshsv@gmail.com> Fri, 26 August 2016 08:10 UTC

Return-Path: <smyshsv@gmail.com>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5C94F12D09C for <tls@ietfa.amsl.com>; Fri, 26 Aug 2016 01:10:32 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.699
X-Spam-Level:
X-Spam-Status: No, score=-2.699 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id t0kdbIKwkKGY for <tls@ietfa.amsl.com>; Fri, 26 Aug 2016 01:10:31 -0700 (PDT)
Received: from mail-qk0-x233.google.com (mail-qk0-x233.google.com [IPv6:2607:f8b0:400d:c09::233]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EE49C12D12E for <tls@ietf.org>; Fri, 26 Aug 2016 01:04:30 -0700 (PDT)
Received: by mail-qk0-x233.google.com with SMTP id l2so69479182qkf.3 for <tls@ietf.org>; Fri, 26 Aug 2016 01:04:30 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=i3J25FPSzx4HFloejYJGq7AniBOyNdpjCGsaFPRIOxs=; b=c0l5cPdj2G56HNcCxMHVPFnGcyGhLD2jvtl/wZIQBco+aDkZ47hpS9W8TfR24V0Lxs BQQfDiO9cC3YD2YPKs9rSb18qoqgT8s2PkOUrqUvneSaBccVtnmN7Xo5CslTZRqa8/Yw WqK+PSYtSVzeEf5nqKszeJqy6iBBwOFYjIEFHgk+3bG0X6bVMDt62RsvESzmMEAo3bLg vgB6C8vG+Sv8AFHvhBSB8qtFfzM+muOOMYLqjoqMSVgtafTated9268hiKeOA5DS117Y bibn9IK0fO34o6hsX6oUVDnA3k/r54aCqj9ZafaJlKsxeTfIBjbxwoGDu5rzHmhl8O0Y BenQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=i3J25FPSzx4HFloejYJGq7AniBOyNdpjCGsaFPRIOxs=; b=RbV3pAtDs93TCT/B4+QzaOMpAHurR1GkB3lyBNWIvuj+8wzS+lB0sM7Y3ELx53yOCb FgI1xfcy6kz25sTNk55+1GzzxlZys+2QerhcNwp7hu0chPdGtTMh8Sg8uk5qpWtiMk1W OAFpTGL1Yg+hGTpdhNteTlZLUrIXIzrh8znS87sl4fMULvKPM169RWsjc6sS6+rcZE3f MpP7MO9ZUN9joJhY1pble564JXYiDiHR7S0ZhlXp7b8qlyRAWYVhmX95oyvb6jmU+Sjh MyadqGHGWLruQ+rn6CX1oN6vltKtrxWZ+/eT4NCPOcOzTSTKxmjwWZjlLqrY/ESx9yX3 AMFw==
X-Gm-Message-State: AE9vXwOrqxZbidd7T1xa8k1XjRrjOZitSv55i366lvS2gym7TL5QXLGXHfHWW/8+Gmzu16MlMNXL+l80FufQTw==
X-Received: by 10.55.209.142 with SMTP id o14mr1914750qkl.266.1472198670103; Fri, 26 Aug 2016 01:04:30 -0700 (PDT)
MIME-Version: 1.0
Received: by 10.200.50.86 with HTTP; Fri, 26 Aug 2016 01:04:29 -0700 (PDT)
In-Reply-To: <CADqLbz+nuAkc-m=O6110H2d-1xpy3DXq_XgpxfTfP=fEGt1+xg@mail.gmail.com>
References: <CAHOTMV+r5PVxqnSozYyqJqq_YocMKV06aAa-43t+5Huzh7Lo=A@mail.gmail.com> <CADqLbz+nuAkc-m=O6110H2d-1xpy3DXq_XgpxfTfP=fEGt1+xg@mail.gmail.com>
From: "Stanislav V. Smyshlyaev" <smyshsv@gmail.com>
Date: Fri, 26 Aug 2016 11:04:29 +0300
Message-ID: <CAMr0u6nLn1yf2rcS+g_ABP_-qHVJ1BZjO8Gg-tgRGCdYeboY+g@mail.gmail.com>
To: Dmitry Belyavsky <beldmit@gmail.com>
Content-Type: multipart/alternative; boundary=001a11479db0c53f48053af4f634
Archived-At: <https://mailarchive.ietf.org/arch/msg/tls/rUnelMJgOJHyA-2SIwHG9Eqg_wE>
Cc: "cfrg@irtf.org" <cfrg@irtf.org>, "<tls@ietf.org>" <tls@ietf.org>
Subject: Re: [TLS] [Cfrg] 3DES diediedie
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.17
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 26 Aug 2016 08:10:32 -0000

Dear colleagues!

I'd like to add that the described key meshing procedures (procedures to
increase the lifetime of a key) are proven to be secure (and increasing
security) in case of usage of CTR mode – see preprint at
http://eprint.iacr.org/2016/628.pdf

In case of CBC/CFB modes an additional separate key for key meshing should
be used.

Kindest regards,
Stanislav


2016-08-26 10:58 GMT+03:00 Dmitry Belyavsky <beldmit@gmail.com>om>:

> Hello all,
>
> Regarding the discussion of the Sweet32 attack, it's worth mentioning that
> there is a specification of so called key meshing for the Russian GOST
> cipher (which has 64-bit block as well).
> Key meshing is a procedure of a predictable change of the current key
> after processing an certain amount of data.
> It is described in RFC 4357, Section 2.3 (https://tools.ietf.org/html/
> rfc4357#section-2.3).
>
> This key meshing defends against any attack that uses a big portion of
> data encrypted with the same key.
>
> May be it is useful to specify the similar procedure for modern ciphers
> too.
>
>
> On Thu, Aug 25, 2016 at 5:08 AM, Tony Arcieri <bascule@gmail.com> wrote:
>
>> This attack was published today[*]:
>>
>> https://sweet32.info/
>>
>> I bring it up because I think the threat model is similar to the threats
>> that lead to RC4 "diediedie"
>>
>> https://www.rfc-editor.org/info/rfc7465
>>
>> Should there be a 3DES "diediedie"?
>>
>> I believe 3DES is MTI for TLS 1.0/1.1(?) but I think it would make sense
>> for it to be banned from TLS 1.3.
>>
>> [*] Lest anyone claim the contrary, I am not surprised by this attack,
>> and have pushed to have 3DES removed from TLS prior to the publication of
>> this attack, and can probably find a TLS implementer who can back me up on
>> that.
>>
>> --
>> Tony Arcieri
>>
>> _______________________________________________
>> TLS mailing list
>> TLS@ietf.org
>> https://www.ietf.org/mailman/listinfo/tls
>>
>>
>
>
> --
> SY, Dmitry Belyavsky
>
> _______________________________________________
> Cfrg mailing list
> Cfrg@irtf.org
> https://www.irtf.org/mailman/listinfo/cfrg
>
>