Re: [TLS] Data volume limits

Watson Ladd <watsonbladd@gmail.com> Wed, 16 December 2015 00:31 UTC

Return-Path: <watsonbladd@gmail.com>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EC9381A0056 for <tls@ietfa.amsl.com>; Tue, 15 Dec 2015 16:31:06 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.699
X-Spam-Level:
X-Spam-Status: No, score=-1.699 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, MIME_8BIT_HEADER=0.3, SPF_PASS=-0.001] autolearn=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id EKktSEgN2B8t for <tls@ietfa.amsl.com>; Tue, 15 Dec 2015 16:31:05 -0800 (PST)
Received: from mail-qk0-x231.google.com (mail-qk0-x231.google.com [IPv6:2607:f8b0:400d:c09::231]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 512841A004D for <tls@ietf.org>; Tue, 15 Dec 2015 16:31:05 -0800 (PST)
Received: by mail-qk0-x231.google.com with SMTP id p187so41014852qkd.1 for <tls@ietf.org>; Tue, 15 Dec 2015 16:31:05 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=DIRNZW2wALP7P+dh0hLPvUc4AUSGllE74rQAe+U8VJo=; b=w12CPkTH8U1DrLrJ16PFsvohS8y1f/XTkfr2FxbZZjbhNhzHH8jp747v10HYqy/BNx vNAy11+6232JatS8nhKD2EAC+MCFmVDp5ozKE5jUNOx2au2ARd3c6cWGQfcIVJpCT85a DuC0satCdHqgTE1gphM468aoSPuNnJXb/JT63mevcSGX94z3lsqCHbqZkZO7uaJ5/yT7 m6JhUMwwyPBq945nfCfz/W7/uQl51jdG73UqKmXjUNgp/TbKZ9RowwtSlmF2dF6bpbL2 uBRS0OF3crGnRf8Uz7hD6DmwFSt+SzsnGzMUMtgwncgI7rv70Y8bPxN6loKKCh6mks4R T04g==
MIME-Version: 1.0
X-Received: by 10.129.57.135 with SMTP id g129mr24598498ywa.244.1450225864428; Tue, 15 Dec 2015 16:31:04 -0800 (PST)
Received: by 10.129.148.131 with HTTP; Tue, 15 Dec 2015 16:31:04 -0800 (PST)
Received: by 10.129.148.131 with HTTP; Tue, 15 Dec 2015 16:31:04 -0800 (PST)
In-Reply-To: <5670AB96.9000602@streamsec.se>
References: <CABcZeBNR76DqPo0Mukf5L2G-WBSC+RCZKhVGqBZq=tJYfEHLUg@mail.gmail.com> <e007baa2f53249d49917e6023e578bc0@XCH-RTP-006.cisco.com> <CACsn0ckSo-affRmsTZaodCJZsFisPygnhk9=OZuV0_9SVMbUxQ@mail.gmail.com> <6674a4ec51fe4e158929bf429260d6ea@XCH-RTP-006.cisco.com> <CABcZeBNSHGGwM41c9QS0G-pnsEkuyA-q6FMhMgv2NQBDmwWwqA@mail.gmail.com> <5670AB96.9000602@streamsec.se>
Date: Tue, 15 Dec 2015 19:31:04 -0500
Message-ID: <CACsn0c=FyAn+EqmLTpQj=4U4RckCZFokhc8FLQhvJ1YDVs+aVQ@mail.gmail.com>
From: Watson Ladd <watsonbladd@gmail.com>
To: =?UTF-8?Q?Henrick_Hellstr=C3=B6m?= <henrick@streamsec.se>
Content-Type: multipart/alternative; boundary=001a114c78fe7e53110526f9051d
Archived-At: <http://mailarchive.ietf.org/arch/msg/tls/wMkK0ftqUQw-D-wsO0WW_DCzMis>
Cc: tls@ietf.org
Subject: Re: [TLS] Data volume limits
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 16 Dec 2015 00:31:07 -0000

On Dec 15, 2015 7:09 PM, "Henrick Hellström" <henrick@streamsec.se> wrote:
>
> On 2015-12-16 00:48, Eric Rescorla wrote:
>>
>>
>>
>> On Tue, Dec 15, 2015 at 3:08 PM, Scott Fluhrer (sfluhrer)
>> <sfluhrer@cisco.com <mailto:sfluhrer@cisco.com>> wrote:
>>     The quadratic behavior in the security proofs are there for just
>>     about any block cipher mode, and is the reason why you want to stay
>>     well below the birthday bound.
>>
>>
>> The birthday bound here is 2^{64}, right?
>>
>> -Ekr
>>
>>        However, that's as true for (say) CBC mode as it is for GCM
>
>
> Actually, no.
>
> Using the sequence number as part of the effective nonce, means that it
won't collide. There is no relevant bound for collisions in the nonces or
in the CTR state, because they simply won't happen (unless there is an
implementation flaw). There won't be any potentially exploitable collisions.

You don't understand the issue. The issue is PRP not colliding, whereas PRF
can.

>
> However, theoretically, the GHASH state might collide with a 2^{64}
birthday bound. This possibility doesn't seem entirely relevant, though.
>
>
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls