Re: [TLS] Rizzo claims implementation attach, should be interesting

[Martin Rex <[e-mail]>]

Geoffrey Keating wrote:
> 
> Martin Rex <[e-mail]> writes:
> 
> > SSL was NEVER designed with a promise that you could multiplex
> > data from an evil attack with data from a victim over the very same
> > SSL connection and be secure against adaptive chose plaintext
> > attacks trying to recover data from the victim.
> 
> This would imply that you should not use SSL for downloading e-mail
> using POP or IMAP, because that's multiplexing evil data (mail sent to
> you by the attacker) with trusted data (credentials and non-evil
> mail).
 
You are quite correct in recognizing that you might be helping
the attacker in a known-plaintext or chosen-plaintext attack (and when
you have an automatically polling IMAP client, maybe even an adaptive
chosen-plaintext attack).  So it would be sensible to limit the number
of guesses for the attacker, and to not re-use the same crypto keys
on subsequent accesses to the same IMAP server (TLS does the latter for
you when you create a new TLS connection state for each subsequent access,
i.e. TLS session resume or full handshake, both will do).


-Martin