Re: [TLS] AAED ciphers: AES-GCM vs AES-EAX/AES-CCM: a meta-analysis

[Watson Ladd <[e-mail]>]

On Tue, Jan 13, 2015 at 10:15 AM, Paterson, Kenny
<[e-mail]> wrote:
> Hi Watson,
>
> On 13/01/2015 18:09, "Watson Ladd" <[e-mail]> wrote:
>
> >From what I understand, when AES-GCM is used there isn't any padding,
>>and the length of the encrypted record is equal to the unencrypted one
>>plus the tag,
>
> True.
>
>>so this attack still works.
>
> Actually, it's an even simpler, passive attack for AES-GCM - you just
> observe the ciphertext length and you are done. The attack on CBC mode
> requires an activity adversary and leads to closure of the TLS session
> half of the time.
>
>>So if we accept this attack
>>(and I think we should), then the way AEAD ciphers are used in TLS are
>>also insecure. I believe this attack got used to determine autofill
>>entries in the Google search bar via passive observation, but I've not
>>dug up the paper, so my memory may be wrong.
>
> That would be an interesting reference to have to hand. Please dig!

https://eprint.iacr.org/2014/959.pdf is the paper I was thinking of.

>
>>To fix this we need to add padding in TLS 1.3 and TLS 1.2 for AEAD modes.
>
> https://tools.ietf.org/html/draft-pironti-tls-length-hiding-01 would be a
> good starting point, no?

Seem to be, although I don't remember it being discussed on the list
before. We should fix this problem.

>
>
> Cheers
>
> Kenny
>



-- 
"Those who would give up Essential Liberty to purchase a little
Temporary Safety deserve neither  Liberty nor Safety."
-- Benjamin Franklin