Re: [TLS] Fwd: New Version Notification for draft-sheffer-tls-bcp-00.txt

["Paterson, Kenny" <[e-mail]>]

Dear Yaron, 

Thanks for sharing this draft.

Some quick points of feedback:

* Firstly, you asked:

[[Is it possible to affect some length hiding using TLS 1.2 as
   specified today, i.e. without draft-pironti-tls-length-hiding-01, and
   using available APIs?]]


The answer is "yes, to some extent, and for some cipher suites, but it
does not help much against compression attacks".

Expanding: variable length padding is available for CBC-mode ciphersuites
in TLS 1.0 and higher (but not widely implemented). This allows an
implementation to "disguise" the underlying message size to some extent,
and it can be proven to be secure providing you avoid short MAC tags as in
RFC 6066 (see my paper with Ristenpart and Shrimpton from Asiacrypt 2011:
http://www.isg.rhul.ac.uk/~kp/mee-comp.pdf).

Such padding is not available for RC4-based ciphersuites, nor for AES-GCM,
nor AES-CCM. 

The amount of variability this feature introduces into ciphertext lengths
is not sufficient to prevent CRIME/BREACH, but only slows them down a bit
(I have not quantified this; that would require a more detailed analysis
which is not justified given the apparent benefit).

 
* Secondly, concerning attacks on RC4:

You mention the work of Isobe et al. from FSE 13 (as citation
[RC4-Attack]). I've also been involved in parallel work which goes more
deeply into the practical applications of RC4 weaknesses to breaking TLS
and which includes more powerful attacks, making the case for abandoning
RC4 even stronger:

N.J. AlFardan, D.J. Bernstein, K.G. Paterson, B. Poettering and J.C.N.
Schuldt. On the Security of RC4 in TLS. In USENIX Security Symposium 2013.

https://www.usenix.org/conference/usenixsecurity13/security-rc4-tls

http://www.isg.rhul.ac.uk/tls


* Thirdly, a technical point concerning CRIME/BREACH:

You write: "The attack is a consequence of the TLS MAC-then-encrypt
approach."


This is incorrect. The attacks would apply equally well to AES-GCM
ciphersuites (which do not adopt the MAC-then-ecnrypt approach).


Regards

Kennt


On 08/09/2013 09:25, "Yaron Sheffer" <[e-mail]> wrote:

>This is an early version of my proposal for a BCP-like document, to
>inform the industry on what can be done with existing implementations,
>while TLS 1.3 is still not ready.
>
>I would appreciate your comments of course. Specifically,
>I would like to fill in the Implementation Status table (Sec. 5) and
>would be glad to receive solid information (dates, planned dates,
>version numbers) from implementers.
>
>Thanks,
>	Yaron
>
>-------- Original Message --------
>Subject: New Version Notification for draft-sheffer-tls-bcp-00.txt
>Date: Sat, 07 Sep 2013 15:46:38 -0700
>From: [e-mail]
>To: Yaron Sheffer <[e-mail]>
>
>
>A new version of I-D, draft-sheffer-tls-bcp-00.txt
>has been successfully submitted by Yaron Sheffer and posted to the
>IETF repository.
>
>Filename:	 draft-sheffer-tls-bcp
>Revision:	 00
>Title:		 Recommendations for Secure Use of TLS and DTLS
>Creation date:	 2013-09-08
>Group:		 Individual Submission
>Number of pages: 8
>URL: 
>http://www.ietf.org/internet-drafts/draft-sheffer-tls-bcp-00.txt
>Status:          http://datatracker.ietf.org/doc/draft-sheffer-tls-bcp
>Htmlized:        http://tools.ietf.org/html/draft-sheffer-tls-bcp-00
>
>
>Abstract:
>    Over the last few years there have been several serious attacks on
>    TLS, including attacks on its most commonly used ciphers and modes of
>    operation.  This document offers recommendations on securely using
>    the TLS and DTLS protocols, given existing standards and
>    implementations.
>
> 
>
>
>
>Please note that it may take a couple of minutes from the time of
>submission
>until the htmlized version and diff are available at tools.ietf.org.
>
>The IETF Secretariat
>
>
>
>_______________________________________________
>TLS mailing list
>[e-mail]
>https://www.ietf.org/mailman/listinfo/tls
>
>
>