Re: [TLS] Rethink TLS 1.3

[Nico Williams <[e-mail]>]

On Mon, Nov 24, 2014 at 01:06:47PM +0100, Florian Weimer wrote:
> I really doubt that when people talked about the Internet threat
> model ten, fifteen years ago, they had adaptive chosen plaintext
> attacks in mind.  For example, they are not discussed in
> <http://tools.ietf.org/html/draft-rescorla-sec-cons-05> (as far as I
> can tell).  If such attacks are covered by the Internet threat model
> today, the model has evolved considerably.

They are active attacks by an attacker with full control of the network
between the end-points under attack.  Therefore they fall squarely under
the traditional Internet threat model.  We have to take into account
even attacks that today seem difficult to mount (as this one seemed not
that long ago), but we can't predict future new active attacks.  And yet
new future active attacks will still be active attacks.

I'm not saying that the Internet threat model doesn't require updating
(it does, at least as to massive adversary capabilities).  I'm saying we
shouldn't blame TLS's shortcommings on the Internet threat model.  The
latter is very high-level, and can't cover every eventually in its small
print, but in its high-level view, adaptive chosen plaintext attacks
were covered.

Nico
--