IETF Logo Mail Archive

Re: [TLS] draft-turner-ssl-must-not

Peter Gutmann <pgut001@cs.auckland.ac.nz> Tue, 06 July 2010 05:30 UTC

Return-Path: <pgut001@cs.auckland.ac.nz>
X-Original-To: tls@core3.amsl.com
Delivered-To: tls@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 031E33A69FF for <tls@core3.amsl.com>; Mon, 5 Jul 2010 22:30:30 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.599
X-Spam-Level:
X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Tv6YZPxoObvT for <tls@core3.amsl.com>; Mon, 5 Jul 2010 22:30:28 -0700 (PDT)
Received: from mx2-int.auckland.ac.nz (mx2-int.auckland.ac.nz [130.216.12.41]) by core3.amsl.com (Postfix) with ESMTP id 4DD733A68B2 for <tls@ietf.org>; Mon, 5 Jul 2010 22:30:22 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=auckland.ac.nz; i=pgut001@cs.auckland.ac.nz; q=dns/txt; s=uoa; t=1278394230; x=1309930230; h=from:to:subject:cc:in-reply-to:message-id:date; z=From:=20Peter=20Gutmann=20<pgut001@cs.auckland.ac.nz> |To:=20bmoeller@acm.org,=20marsh@xs01.extendedsubset.com |Subject:=20Re:=20[TLS]=20draft-turner-ssl-must-not|Cc: =20tls@ietf.org|In-Reply-To:=20<20100706050000.GB31051@xs 01.extendedsubset.com>|Message-Id:=20<E1OW0jc-00061Y-3N@w intermute02.cs.auckland.ac.nz>|Date:=20Tue,=2006=20Jul=20 2010=2017:30:20=20+1200; bh=uTiLsIoZ+AJl+X7Rd0sWTjN976flWx4jv115ko8W19E=; b=fRpC07Ng/e9IDP/AQaUZ69M2GvenZtQthLfOacS6JTlLoghNhplvpW1P NI0Ydf5L7MI8NTymtiU4Z0wEsi8AyousVZJxHVr6y5b568iNjpAVPrRFJ Xt8wzl61d0mBACbDIff/IGTJoEyaI4r6IJmNgZ7L871kcbX9zR1xTH+5t Y=;
X-IronPort-AV: E=Sophos;i="4.53,544,1272801600"; d="scan'208";a="14048868"
X-Ironport-HAT: UNIVERSITY - $RELAY-THROTTLE
X-Ironport-Source: 130.216.207.92 - Outgoing - Outgoing
Received: from wintermute02.cs.auckland.ac.nz ([130.216.207.92]) by mx2-int.auckland.ac.nz with ESMTP/TLS/AES256-SHA; 06 Jul 2010 17:30:20 +1200
Received: from pgut001 by wintermute02.cs.auckland.ac.nz with local (Exim 4.69) (envelope-from <pgut001@cs.auckland.ac.nz>) id 1OW0jc-00061Y-3N; Tue, 06 Jul 2010 17:30:20 +1200
From: Peter Gutmann <pgut001@cs.auckland.ac.nz>
To: bmoeller@acm.org, marsh@xs01.extendedsubset.com
In-Reply-To: <20100706050000.GB31051@xs01.extendedsubset.com>
Message-Id: <E1OW0jc-00061Y-3N@wintermute02.cs.auckland.ac.nz>
Date: Tue, 06 Jul 2010 17:30:20 +1200
Cc: tls@ietf.org
Subject: Re: [TLS] draft-turner-ssl-must-not
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/tls>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 06 Jul 2010 05:30:30 -0000

Marsh Ray <marsh@xs01.extendedsubset.com> writes:

>So we definitely have some red flags going up here:
>
>   * Raw hashes used without HMAC for signing important stuff
>   * Concatenated iterated hash functions
>   * Mitm can manipulate variable-length data under the hash in both
>     directions

For its use in Finished though we also have some anti-red flags: The attacks
on MD5 rely on fixed, known input and huge amounts of offline computation.  In
this case we have unknown input (until the time the handshake takes place), a
limited timeout period after which a collision won't be useful any more, and
the need to break (find a collision) for both MD5 and SHA-1 simultaneously,
not just MD5.  On my list of things to worry about I've got it somewhere down
near "server struck by meterorite".

Peter.

v2.23.0 | Report a Bug | By Email