Re: [TLS] [Technical Errata Reported] RFC7905 (5251)

[Adam Langley <[e-mail]>]

On Mon, Feb 12, 2018 at 4:22 PM, Xavier Bonnetain
<[e-mail]> wrote:
> If we are in the situation C = 0, D = 1 and L=2^{14} for (D)TLS, the forgery probability may indeed not be affected (and may even be smaller). However, the explanation "Poly1305 is designed to ensure that forged messages are rejected with a probability of 1-(n/2^107), where n is the maximum length of the input to Poly1305." is presenting Poly1305 as slightly stronger than it really is (and there is an attack with success probability 2^{-106} with C=1, D=1, L=1, as the hashing key r has 106 effective bits).

I don't believe that this contradicts the equation. While it's true
that r only contains 106 bits, knowing r isn't sufficient to forge a
message unless one also has a legitimate message from which to
calculate the masking value. In the C = 0 situation, the attacker does
not have such a message. As the attacker gathers samples of legitimate
messages, their success probability does, indeed, increase.

I suspect that any simplification of the security equation is going to
have these issues.


Cheers

AGL