IETF Logo Mail Archive

Re: [TLS] Call for Consensus on removal of renegotiation

Yoav Nir <ynir.ietf@gmail.com> Thu, 26 June 2014 16:27 UTC

Return-Path: <ynir.ietf@gmail.com>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 168271B28DA for <tls@ietfa.amsl.com>; Thu, 26 Jun 2014 09:27:57 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2
X-Spam-Level:
X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id sX304U8cJIjN for <tls@ietfa.amsl.com>; Thu, 26 Jun 2014 09:27:54 -0700 (PDT)
Received: from mail-wg0-x22c.google.com (mail-wg0-x22c.google.com [IPv6:2a00:1450:400c:c00::22c]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A80C61B2900 for <tls@ietf.org>; Thu, 26 Jun 2014 08:48:47 -0700 (PDT)
Received: by mail-wg0-f44.google.com with SMTP id x13so3883996wgg.15 for <tls@ietf.org>; Thu, 26 Jun 2014 08:48:46 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=content-type:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=go/RkyatJdt+iqIxN1W77bLXWDisqh/I/4uljukqIzA=; b=Wz02lE90IV/s01ZcN3tOqBTL0895lVbsJYnNCLwF2c2t41f9Ap1eGNErgYw6PvUSxH AImVuhhPLF0O6lTwYu+8ixYNzL2x01g6N59wvJGS7bwhVZ5xDRedw8irTKH5PnGDpYsQ aOUntF3CALxNiBoeU0+r/X3xVFT8pRfAkEHAYvkq+xZCGYXLQSySRMTD8WlGLb7+DkDx lFEHCNV4Oj5lhkRvVby8uPeiftGEUxjbyXkE4ASd3aXap05igBgUxpbO7Voddj4/ccAZ u0kBb93RWaLosgBzFe+RobqQuamVijbYjMFiJcJ9JnEpIeR7yIpjFrv1H716fjoE9Aaf U+7Q==
X-Received: by 10.180.19.70 with SMTP id c6mr5326449wie.19.1403797725912; Thu, 26 Jun 2014 08:48:45 -0700 (PDT)
Received: from [10.4.19.106] ([82.102.169.113]) by mx.google.com with ESMTPSA id w5sm67206632wif.3.2014.06.26.08.48.43 for <multiple recipients> (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Thu, 26 Jun 2014 08:48:45 -0700 (PDT)
Content-Type: text/plain; charset="windows-1252"
Mime-Version: 1.0 (Mac OS X Mail 7.3 \(1878.2\))
From: Yoav Nir <ynir.ietf@gmail.com>
In-Reply-To: <2082143270.33157164.1403779796220.JavaMail.zimbra@redhat.com>
Date: Thu, 26 Jun 2014 18:48:33 +0300
Content-Transfer-Encoding: quoted-printable
Message-Id: <E4994CAA-947E-43A5-962B-B12CFEF704BB@gmail.com>
References: <44DA5A30-015D-40F3-90CA-F15076891BBC@cisco.com> <53AB192F.2040001@fifthhorseman.net> <CAAF6GDdkkuB=Eko55vqaPS9Krc0XmiQk0vo2c_q5n6kydpkYuQ@mail.gmail.com> <B18B3440-8CBF-4B04-B792-F81FBF0CE8AC@gmail.com> <2A0EFB9C05D0164E98F19BB0AF3708C71854BEF192@USMBX1.msg.corp.akamai.com> <6B247363-E6E2-4A81-92D8-FE2F02C14227@gmail.com> <2A0EFB9C05D0164E98F19BB0AF3708C71854BEF1A5@USMBX1.msg.corp.akamai.com> <3E3ED127-E1DE-469A-A322-8B14856CFEE9@gmail.com> <2082143270.33157164.1403779796220.JavaMail.zimbra@redhat.com>
To: Hubert Kario <hkario@redhat.com>
X-Mailer: Apple Mail (2.1878.2)
Archived-At: http://mailarchive.ietf.org/arch/msg/tls/w2VTqnnD0oa6bbD4JCz9lzl3ZSo
Cc: tls <tls@ietf.org>
Subject: Re: [TLS] Call for Consensus on removal of renegotiation
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 26 Jun 2014 16:27:57 -0000

On Jun 26, 2014, at 1:49 PM, Hubert Kario <hkario@redhat.com> wrote:

> ----- Original Message -----
>> From: "Yoav Nir" <ynir.ietf@gmail.com>
>> To: "Rich Salz" <rsalz@akamai.com>
>> Cc: "<tls@ietf.org>" <tls@ietf.org>
>> Sent: Wednesday, 25 June, 2014 11:06:11 PM
>> Subject: Re: [TLS] Call for Consensus on removal of renegotiation
>> 
>> 
>> On Jun 25, 2014, at 11:52 PM, Salz, Rich <rsalz@akamai.com> wrote:
>> 
>>> 
>>> I believe the consensus is to adopt
>>> http://datatracker.ietf.org/doc/draft-thomson-tls-care/ which I prefer to
>>> think of as "do have any idea who I am”
>> 
>> I must have missed when they called consensus on that. In that case, I’m with
>> the “remove it entirely (1)” camp. We use 128-bit ciphers today. Even with
>> CBC, you will replace the client and the server long before you’ve encrypted
>> so much that you need to rekey.  Periodic rekeying is something that
>> auditors like, but is very rarely needed in HTTPS, SMTP and the like. I’m
>> fine with forcing the few applications that need to to adapt.
> 
> Current FIPS states that you can't encrypt more than 64GiB with a single key
> using AES-GCM. It's not a lot, and it is definetely in the realm of possibility
> even for HTTPS (games, disk images), let alone actually long lived connections…

That number seemed suspiciously low, so I went and read SP-800-38D.

It recommends two different limits depending on the length of the IV.

For IVs that are constructed deterministically, but whose length is *not* 96 bits, the limit is 2^32 invocations. 2^32 invocations means 4 billion TLS records, which could be up to 16 Terabytes.

But that doesn’t matter anyway, because in TLS the recommendation is to create the nonce deterministically and the length *is* 96 bits, so the limit is 2^64 invocations. 

Even with 1-byte records, that’s more terabytes than we know what to do with.

So I stand by what I said earlier. Just because of volume, there is no reason to rekey an AES session.

Yoav

v2.23.0 | Report a Bug | By Email