IETF Logo Mail Archive

Re: [TLS] Security review of TLS1.3 0-RTT

Colm MacCárthaigh <colm@allcosts.net> Thu, 04 May 2017 20:21 UTC

Return-Path: <colm@allcosts.net>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 354E7129789 for <tls@ietfa.amsl.com>; Thu, 4 May 2017 13:21:48 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.599
X-Spam-Level:
X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=allcosts-net.20150623.gappssmtp.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id w34Pt-jsJ-iR for <tls@ietfa.amsl.com>; Thu, 4 May 2017 13:21:47 -0700 (PDT)
Received: from mail-yw0-x229.google.com (mail-yw0-x229.google.com [IPv6:2607:f8b0:4002:c05::229]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4686E129B70 for <tls@ietf.org>; Thu, 4 May 2017 13:21:44 -0700 (PDT)
Received: by mail-yw0-x229.google.com with SMTP id l18so12403777ywh.3 for <tls@ietf.org>; Thu, 04 May 2017 13:21:44 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=allcosts-net.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=M5QDYnwAD2hUuEBPBTLxA4r2xT6jIPSl/2vYF14Lcr0=; b=2LjW6BpMofoVezCFOqbwmfnUZAUufwyG4gGsQoTc/7MwdUl3QssxN+zWMkCG6P/8TO 4iynQyiLAvblzhDT0womoNR4/sZP7Bn7nmG0B3l5LRMAoyLwVzmsHIDeCqKy6QKppGRO BiSuwayxP1QIcXvxkTJ4+HWo0+aQvTRezVMQvXAvzEVYRzVrjHez+Q91ut77yS1um/JS O8QY5tHDO9Wj7lkBicYAYU3I2ygpE03E2xKxYH11jRPOTdccB0wOH0gq/7odhT4FNTQq zBF2+71YyJ4AluEFWAyinnZzXaP9KXqxISscOVbQQ6doBh31/r0B+izJCnyqKYIffKxX mNhA==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=M5QDYnwAD2hUuEBPBTLxA4r2xT6jIPSl/2vYF14Lcr0=; b=hMQ9ZsG/zIddyrB97h/CmajQc1JLHKuM927vyPKXULkxYY9I5LGDgayitgd+hq4HyK 5v/+sC6Ss7HhK4D0m0IK9HwrRUEtkSkjqZCEFXpgv7GXQLGHHNzohDD1qru6tgGpB4vp yaLI0Dl1rfOKJu5mRoGeax4r6ZqzAHhvO/pldflzk9Vip33zA49fZE5ByJn7bbZNvHT0 Lk2h5EhivTSlabRksB4qJYxT7hV5RYRHgr0scwLf1Ixj50yksRGT0CBLurhRoUMMi+BK 7Hyr2OM+8cGZnufYT+tPOEWuOsURKphjpOO42jXfaE8Kc8Z+vdn8F1HiAi20jB8viToy DLAw==
X-Gm-Message-State: AN3rC/5EmfmDZ5Kniee3HNZ0UypdLoR9FnVjAc60KEh8FSO3UfsbgY/G 1VJp6TeXzkbko7EevhxktMhht1KD+w==
X-Received: by 10.129.157.142 with SMTP id u136mr8008067ywg.323.1493929303554; Thu, 04 May 2017 13:21:43 -0700 (PDT)
MIME-Version: 1.0
Received: by 10.129.57.67 with HTTP; Thu, 4 May 2017 13:21:43 -0700 (PDT)
In-Reply-To: <20170504193953.GU10188@localhost>
References: <CAAF6GDcKZj9F-eKAeVj0Uw4aX_EgQ4DuJczL4=fsaFyG9Yjcgw@mail.gmail.com> <CABcZeBNcnW9zEPZ4mEje1_ejR3npNFz65rw-6qUPn7cQt1Nz9w@mail.gmail.com> <CAKC-DJhYSCrsXQZS0SMB7ebSTYM49U+dv5iSXx5MSAv4pthabg@mail.gmail.com> <20170504193953.GU10188@localhost>
From: Colm MacCárthaigh <colm@allcosts.net>
Date: Thu, 04 May 2017 13:21:43 -0700
Message-ID: <CAAF6GDcH8q0MwA2bzFjGkRBDD3qV=LWWQPpLF=oHBXn0k1kWpg@mail.gmail.com>
To: Nico Williams <nico@cryptonector.com>
Cc: Erik Nygren <erik+ietf@nygren.org>, "tls@ietf.org" <tls@ietf.org>
Content-Type: multipart/alternative; boundary="94eb2c0b68aa7565c8054eb88549"
Archived-At: <https://mailarchive.ietf.org/arch/msg/tls/yFiVxWujw-DOgel1OpafjwtzzzU>
Subject: Re: [TLS] Security review of TLS1.3 0-RTT
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 04 May 2017 20:21:48 -0000

On Thu, May 4, 2017 at 12:39 PM, Nico Williams <nico@cryptonector.com>
wrote:

> The SHOULD should say that the server-side needs to apply a replay cache
> OR fallback onto a full exchange when the 0-rtt data payload involves a
> non-idempotent operation.
>

I don't mean to be dismissive with this but TLS stands for "Transport Layer
Security". The transport layer just isn't aware of what the operations are,
and whether then can be idempotent (99% of the time, the answer is "no").
Only the application can tell, but this violation of layers is what leads
to so many problems. I don't think it's workable.


-- 
Colm

v2.23.0 | Report a Bug | By Email