IETF Logo Mail Archive

Re: [TLS] Static DH timing attack

Dan Brown <danibrown@blackberry.com> Thu, 10 September 2020 15:18 UTC

Return-Path: <danibrown@blackberry.com>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6E1373A0869; Thu, 10 Sep 2020 08:18:04 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.099
X-Spam-Level:
X-Spam-Status: No, score=-2.099 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=blackberry.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id iohNKLTL3JQm; Thu, 10 Sep 2020 08:18:02 -0700 (PDT)
Received: from smtp-pg11.blackberry.com (smtp-pg11.blackberry.com [68.171.242.227]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A44373A0801; Thu, 10 Sep 2020 08:18:02 -0700 (PDT)
Received: from pps.filterd (mhs401ykf.rim.net [127.0.0.1]) by mhs401ykf.rim.net (8.16.0.42/8.16.0.42) with SMTP id 08AFFaUs123530; Thu, 10 Sep 2020 11:18:00 -0400
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=blackberry.com; h=from : to : subject : date : message-id : references : in-reply-to : content-type : mime-version; s=corp19; bh=aTx3Fn+U5fEscbXZWlEV8BtH72FNTQ1jTxp8xXgrA5E=; b=T1Pbw4ZQRMngHnx6Nvrg6NdWyxWP0evRh4AOmWtBm/mQOn/ztbbgoqrgsYtkko6BvsOh lCe6gaDYd2B64V+OQDzKqf0FNhi7uooBPJMVy9Df2GmhgetRpmKQoFh/kqggmEdP8Jo4 hiIzRICOzhPaNKjeF/u4qNat8hOpiSKcZtbfjBCmRV6JxlFUVq0JAgPRNzJbvZRRoMkA aEwexumqX3d+8UE44X5zePNWXui4v8WoDGt0BT9zbn5OBdVfhPdzTUlEkWgTeoaKCnZy 5JZF7tGe7Y7RWtxWaa+txQ+A+HvNC2IJWnZYdVNXOVIJDogunfFx3UrkblBIpyEZ4nMJ hA==
Received: from xch214ykf.rim.net (xch214ykf.rim.net [10.2.27.114]) by mhs401ykf.rim.net with ESMTP id 33c5x7avge-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NOT); Thu, 10 Sep 2020 11:18:00 -0400
Received: from XCH210YKF.rim.net (10.2.27.110) by XCH214YKF.rim.net (10.2.27.114) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.1913.5; Thu, 10 Sep 2020 11:18:00 -0400
Received: from XCH210YKF.rim.net ([fe80::ac8d:3541:704c:478a]) by XCH210YKF.rim.net ([fe80::ac8d:3541:704c:478a%5]) with mapi id 15.01.1913.007; Thu, 10 Sep 2020 11:17:59 -0400
From: Dan Brown <danibrown@blackberry.com>
To: "Salz, Rich" <rsalz=40akamai.com@dmarc.ietf.org>, "tls@ietf.org" <tls@ietf.org>
Thread-Topic: Static DH timing attack
Thread-Index: AQHWhrp+9EGmAKHnM0S2YOV3OYQKzqlh+Vhw
Date: Thu, 10 Sep 2020 15:17:59 +0000
Message-ID: <c67ad3e62c4d49dbb17eb29b6fc7ff20@blackberry.com>
References: <5595BB40-3AFD-4327-B7B7-5E63FFC594DD@akamai.com>
In-Reply-To: <5595BB40-3AFD-4327-B7B7-5E63FFC594DD@akamai.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: yes
X-MS-TNEF-Correlator:
x-originating-ip: [100.64.97.68]
Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg="2.16.840.1.101.3.4.2.1"; boundary="----=_NextPart_000_0038_01D68764.0978CF40"
MIME-Version: 1.0
X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.235, 18.0.687 definitions=2020-09-10_04:2020-09-10, 2020-09-10 signatures=0
Archived-At: <https://mailarchive.ietf.org/arch/msg/tls/xSbDJdvQ-mSCXvh21YFQjUGnj4E>
Subject: Re: [TLS] Static DH timing attack
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 10 Sep 2020 15:18:05 -0000

From: TLS <tls-bounces@ietf.org> On Behalf Of Salz, Rich
> Do we need a short RFC saying “do not use static DH” ?

 

Don’t TLS 0-RTT and ESNI/ECH via HPKE use a type of (semi)static ECDH? If so, then an RFC to ban static (EC)DH in TLS would need to be very clear about not referring to these use cases of static ECDH.

 

My 2c. What about combining static ECDH (instead of signatures) with ephemeral ECDH, e.g. for more fully deniable authentication?  (ECMQV does this.)  (Perhaps this is also similar to the KEMTLS proposal for PQC, https://ia.cr/2020/534 - still need to study that.)

 

----------------------------------------------------------------------
This transmission (including any attachments) may contain confidential information, privileged material (including material protected by the solicitor-client or other applicable privileges), or constitute non-public information. Any use of this information by anyone other than the intended recipient is prohibited. If you have received this transmission in error, please immediately reply to the sender and delete this information from your system. Use, dissemination, distribution, or reproduction of this transmission by unintended recipients is not authorized and may be unlawful.

v2.23.0 | Report a Bug | By Email