Re: [TLS] Still missing: TLS_ECDH_anon_WITH_AES_xxx_GCM_SHAxxx

[Alyssa Rowan <[e-mail]>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

On 12 March 2014 12:59:43 GMT+00:00, Daniel Kahn Gillmor <[e-mail]> wrote:
>using certificates and expecting the peer to not validate them has a
>couple downsides:
> 0) [certificate provisioning]
> 1) [TOFU complications]
And an upside: An attacker in a position to MITM in TLSv1.2 would be in a position to see *_anon suites offered: and therefore heuristically guess what the peers will choose and whether an active MITM attack would likely be detected or not.

That would be bad: I think we'll want to conceal that data if possible so that an attacker can't easily distinguish between opportunistic connections they'd succeed silently on (and restrict their MITM to that case, silently decrypting without tripping any warnings and staying under the radar), and authenticated connections in which MITM shenanigans would raise very loud alarm bells. Let's try to keep the "lasers" invisible to third parties, if we can?

Of course if we keep this in mind for TLSv1.3 and the Hellos are encrypted in that version, problem hopefully solved, although the size of the Hello exchange might provide a side channel revealing whether certs were exchanged. Thoughts?

- --
/akr
-----BEGIN PGP SIGNATURE-----
Version: APG v1.0.9

iQI3BAEBCgAhBQJTIF+YGhxBbHlzc2EgUm93YW4gPGFrckBha3IuaW8+AAoJEOyE
jtkWi2t6jAYP/3djv/eTRe7dSzJem8jFYhpwM/PJKq+ZKLx6Kf2RGOrD0QD4r1WS
zgYEPF6rK2tm8s7G4P16emKzV0/L4rk0jE3yfPm8q3+7ce3VkIqxWMiXw18gNK9q
EPcSuQVm1rlLovjvXTqzWL3LVmIQpm4hpGGJ02DjJXcAl5DKyGhTG5pCGQVoyHSA
3zw1q9lD2GcvAh5d5AwXWbbxMmtE4Z5p0GWGq9xGFnYA8CSMU8QvrGhz9C071z97
/HTOZ7YpeiVcXWa4ilQ1PclGe3zJySkLgJwy4PMwOslslITb5HDYi+b7yo+7+L9t
jkLIVKwfX3rI1QZavJRSVCVw49i9f/0+pYwMdZHvcM9y9BHLGOeqZw20RUxaQX7K
vLs0cKvMU5JQDbWO4ZJVVZX8Q6U9ngghdD9qnetyfpQuQpihWQYsp14hiabKsFp0
UaNzeQTop7IM7Y0MFQagFbHRDPO6DK+2t+xtjiTmDW5LuxH4cpbySksum6APeYe+
8dS6wRVosqLHotAoqdIckCkHINzfuFVM8fqRhkofGywAjuXmoC88lq50N5D+guc1
pjO8i4VP5j//nUZ011v4aGrJtV2yxh9ytluhz/fWlNNGcF0OsPliF2KwkxjbS4jd
0rV0c2n321NWyAphynLWF/g1gpC8gHD+KJ6r3e03AQh6nI/0ZTV/WU3s
=S255
-----END PGP SIGNATURE-----