Re: [TLS] Results of interim meeting

[Andy Lutomirski <[e-mail]>]

On Mon, May 26, 2014 at 1:38 PM, Watson Ladd <[e-mail]> wrote:
> On Mon, May 26, 2014 at 12:40 PM, Andy Lutomirski <[e-mail]> wrote:
>> On 05/26/2014 09:34 AM, Watson Ladd wrote:
>>> Dear all,
>>>
>>> It looks like most of the slides were devoted to SNI, and it is not
>>> clear what was actually decided.
>>>
>>> I haven't seen any slides about Triple Handshake, despite being on the
>>> interim agenda. Is this a sign that the proposed fix for TLS 1.2 is
>>> acceptable?
>>
>> There was a concern that the proposed fix might allow the client to
>> construct two different ClientHellos that would nonetheless result in
>> the same tls-unique value using the pre-TLS-1.2 PRFs.  The issue is
>> that, if you could find a SHA-1 collision, then MD5 is short enough that
>> it could be possible to do a length-extension attack and brute-force it
>> to be an MD5 collision as well.
>
> Yes, this is a problem. Basically the session hash needs to be
> computed with a secure hash, and TLS 1.1 and before don't use secure
> hashes.
> I don't think the proposed fix makes this issue worse: from my reading
> of TLS 1.1 and the tls-unique (should be renamed sometime) the
> Finished message is computed with the concatenation of a SHA1 and MD5
> hash of the messages.
>
> How we fix it I don't know yet.
>>
>> No one present knew whether this mattered.
>
> It seems to me that this would be a problem, and is also a problem for
> the TLS 1.1 finished message for the same reason. The core issue is
> this: http://www.iacr.org/cryptodb/archive/2004/CRYPTO/1472/1472.pdf.
>
> In short, with 64 invocations of the hypothetical SHA-1 break, then
> 2^64 MD5 calculations, you find a collision for the TLS 1.1 finished
> message. So the composite construction in TLS 1.0 and TLS 1.1 is no
> more secure than SHA-1. And yes, the dates of TLS 1.1 authorship and
> the authorship of the paper explaining this flaw are 2006 and 2004
> respectively.

My possibly silly suggestion was to replace H(client hello || server
hello) with H(server random || client hello || server hello).  This
may make attacks on this considerably harder to mount.

--Andy