Re: [TLS] Possible timing attack on TLS 1.3 padding mechanism

Martin Thomson <martin.thomson@gmail.com> Fri, 02 March 2018 01:12 UTC

MIME-Version: 1.0
In-Reply-To: <87zi3rs7mh.fsf@fifthhorseman.net>
References: <16A9FD3A-7805-4130-8438-39D0D3E7E3AB@rhul.ac.uk> <87zi3rs7mh.fsf@fifthhorseman.net>
From: Martin Thomson <martin.thomson@gmail.com>
Date: Fri, 02 Mar 2018 12:12:57 +1100
Message-ID: <CABkgnnVEMj7DGN0GxtSwWSfyDhhdXfXoiwA8XE6M5xgLAHo-iQ@mail.gmail.com>
To: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
Cc: "Paterson, Kenny" <Kenny.Paterson@rhul.ac.uk>, "<tls@ietf.org>" <tls@ietf.org>
Content-Type: text/plain; charset="UTF-8"
Archived-At: <https://mailarchive.ietf.org/arch/msg/tls/ybF54PcfT98mXoIesWYqqD7d1hw>
Subject: Re: [TLS] Possible timing attack on TLS 1.3 padding mechanism
Precedence: list

On Fri, Mar 2, 2018 at 10:23 AM, Daniel Kahn Gillmor
<dkg@fifthhorseman.net> wrote:
> You could of course check from the front of the plaintext, keeping every
> non-zero value:
>
>   char ptype = 0;
>   for (i = 0; i < plaintext_len; i++)
>     if plaintext[i]
>       ptype = plaintext[i];

What about ?

size_t l[2];
size_t t[2];
for (i = 0; i < plaintext_len; ++i) {
  l[plaintext[i] != 0] = i;
  t[plaintext[i] != 0] = plaintext[i];
}
unpadded_len = l[0] - 1;
content_type = t[1];

[TLS] cost of padding removal in TLS1.3 [was: Pos… Nikos Mavrogiannopoulos
Re: [TLS] Possible timing attack on TLS 1.3 paddi… Paterson, Kenny
Re: [TLS] Possible timing attack on TLS 1.3 paddi… Eric Rescorla
Re: [TLS] Possible timing attack on TLS 1.3 paddi… Paterson, Kenny
Re: [TLS] Possible timing attack on TLS 1.3 paddi… Colm MacCárthaigh
Re: [TLS] Possible timing attack on TLS 1.3 paddi… David Benjamin
Re: [TLS] Possible timing attack on TLS 1.3 paddi… Daniel Kahn Gillmor
Re: [TLS] Possible timing attack on TLS 1.3 paddi… Martin Thomson
Re: [TLS] Possible timing attack on TLS 1.3 paddi… Eric Rescorla
Re: [TLS] Possible timing attack on TLS 1.3 paddi… Martin Thomson
Re: [TLS] Possible timing attack on TLS 1.3 paddi… Nikos Mavrogiannopoulos
Re: [TLS] Possible timing attack on TLS 1.3 paddi… Paterson, Kenny