Re: [TLS] Are the AEAD cipher suites a security trade-off win with TLS1.2?

Eric Rescorla <ekr@rtfm.com> Sun, 20 March 2016 20:18 UTC

MIME-Version: 1.0
In-Reply-To: <87zitt2af9.fsf@setec.io>
References: <CAAF6GDfsMivA_LiWK2xJgyhMTf8ygFo17MN+YkAnTN2-HV8Ryw@mail.gmail.com> <20160318170854.CB0801A471@ld9781.wdf.sap.corp> <9A043F3CF02CD34C8E74AC1594475C73F4C2687E@uxcn10-tdc05.UoA.auckland.ac.nz> <87zitt2af9.fsf@setec.io>
From: Eric Rescorla <ekr@rtfm.com>
Date: Sun, 20 Mar 2016 13:18:04 -0700
Message-ID: <CABcZeBOz7n2PDXG9RWjpkgwaxiPGN3AMfK1HKsYkHkM08pnePg@mail.gmail.com>
To: Harlan Lieberman-Berg <hlieberman@setec.io>
Content-Type: multipart/alternative; boundary="94eb2c0a876ed63435052e80affa"
Archived-At: <http://mailarchive.ietf.org/arch/msg/tls/y2sAwrhldbX5SwxieqohX3VqOTE>
Cc: "tls@ietf.org" <tls@ietf.org>
Subject: Re: [TLS] Are the AEAD cipher suites a security trade-off win with TLS1.2?
Precedence: list

Note: TLS 1.3 should significantly decrease the risk of this because the
record sequence number is used as the nonce, therefore if you fail to
increment the sequence number, you will quickly not interoperate with
other implementations which are correct.

-Ekr


On Sun, Mar 20, 2016 at 12:53 PM, Harlan Lieberman-Berg <hlieberman@setec.io
> wrote:

> Peter Gutmann <pgut001@cs.auckland.ac.nz> writes:
> > This is why I referred to GCM as "brittle", you can be about as
> > abusive as you like with CBC and the worst you get is degradation to
> > ECB, while with GCM you make one mistake and you get a catastrophic
> > loss of security.
>
> Couldn't you say the same about CTR mode, or stream ciphers themselves?
> Sure -- it's definitely a lot harder to screw up "incrementing a
> counter" than it is all the stuff GCM requires you to do, but....
>
> Sincerely,
>
> --
> Harlan Lieberman-Berg
> ~hlieberman
>
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls
>

[TLS] Are the AEAD cipher suites a security trade… Colm MacCárthaigh
Re: [TLS] Are the AEAD cipher suites a security t… Tom Ritter
Re: [TLS] Are the AEAD cipher suites a security t… Colm MacCárthaigh
Re: [TLS] Are the AEAD cipher suites a security t… Alexandre Anzala-Yamajako
Re: [TLS] Are the AEAD cipher suites a security t… Paterson, Kenny
Re: [TLS] Are the AEAD cipher suites a security t… Adam Langley
Re: [TLS] Are the AEAD cipher suites a security t… Colm MacCárthaigh
Re: [TLS] Are the AEAD cipher suites a security t… Colm MacCárthaigh
Re: [TLS] Are the AEAD cipher suites a security t… Colm MacCárthaigh
Re: [TLS] Are the AEAD cipher suites a security t… Salz, Rich
Re: [TLS] Are the AEAD cipher suites a security t… Benjamin Beurdouche
Re: [TLS] Are the AEAD cipher suites a security t… Martin Rex
Re: [TLS] Are the AEAD cipher suites a security t… Martin Rex
Re: [TLS] Are the AEAD cipher suites a security t… Peter Gutmann
Re: [TLS] Are the AEAD cipher suites a security t… Harlan Lieberman-Berg
Re: [TLS] Are the AEAD cipher suites a security t… Eric Rescorla
Re: [TLS] Are the AEAD cipher suites a security t… Peter Gutmann