RE: [TLS] sending error alerts: MUST? SHOULD? MAY?

Eric Rescorla wrote:
> 
> My concern, as I think I mentioned to you privately, is that we not
> mandate behaviors that potentially leak security relevant information.
> We've had one such situation before with CBC padding. Ultimately,
> we really need a review of the security implications of every kind
> of error, but not having that I'm reluctant to require behaviors
> that haven't been vetted.
> 
> The bottom line, then, is that I'd prefer not to change this language
> without explicit security analysis for each change.

(Replying to a somewhat old message...)

I think a general guideline would be that if you haven't used anything
secret yet (the RSA/DH/DSS private key, or any session keys), sending
an alert can't leak that secret. The problems we've had have all been
associated with revealing errors in processing involving a secret (RSA
errors, CBC padding, etc.).

So some of the alerts (e.g. those sent by server in response to
ClientHello) should be safe, and I do agree with earlier concerns
that the spec should be more clear about when they're used.

Best regards,
Pasi

_______________________________________________
TLS mailing list
TLS@lists.ietf.org
https://www1.ietf.org/mailman/listinfo/tls