Re: [TLS] 0.5 RTT

[Hugo Krawczyk <[e-mail]>]

On Tue, Feb 23, 2016 at 5:08 PM, Martin Thomson <[e-mail]>
wrote:

> On 23 February 2016 at 14:01, Karthikeyan Bhargavan
> <[e-mail]> wrote:
> > The main downgrade concern, I think, is for the 0.5-RTT data’s
> confidentiality; i.e. it may have been sent encrypted under a broken cipher.
>
> Hmm, that's a good point.  So Antoine's analogy is closer to correct
> than I had thought, and the need for Finished remains.
>
> There's an argument that says that 0.5RTT data isn't confidential
> because the server would send it to anyone, but I don't agree with
> that viewpoint.


​I would be interested to hear why you don't agree with that viewpoint.
It seems to imply that you are attaching some "client-specific semantics"
even to keys that were not authenticated by the client.
Understanding such semantics would be a good guide for when 0.5 data may be
safe.

​But the truth is that whatever these semantics are, under your above
viewpoint you should never send 0.5 data.​
​Matching vague semantics to cryptographic security is too hard a problem
to get it right.

(In particular, if these semantics may be based on stuff that happens
outside TLS, as Karthik and Watson were pointing out, then maybe we really
put a "Surgeon General" warning on 0.5 data of equal size to that of 0-RTT.)

Hugo​



And we're potentially also handling 0-RTT data before
> sending 0.5 data.
>
> Like I said on the weekend, we don't have to solve every problem.
> None of the cipher suites in TLS 1.3 would fail to qualify as broken
> currently, but if they did, then logic similar to what we recommend
> for false start seems reasonable to me.  Other than that, we can
> simply document the shortcoming.  I don't think that any of this
> justifies a stronger response than that, and that includes extra key
> updates.
>