Re: [TLS] Fwd: Re: AD review of draft-ietf-tls-dtls-connection-id-07

Achim Kraus <achimkraus@gmx.net> Fri, 30 October 2020 12:28 UTC

Return-Path: <achimkraus@gmx.net>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1BB053A0E3C; Fri, 30 Oct 2020 05:28:25 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.347
X-Spam-Level:
X-Spam-Status: No, score=-2.347 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, NICE_REPLY_A=-0.247, RCVD_IN_MSPIKE_H2=-0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=gmx.net
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id K6VSvYxtFWKi; Fri, 30 Oct 2020 05:28:23 -0700 (PDT)
Received: from mout.gmx.net (mout.gmx.net [212.227.15.15]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 616783A0E3B; Fri, 30 Oct 2020 05:28:23 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=gmx.net; s=badeba3b8450; t=1604060893; bh=LgToqq8e/GoSnUTOSNMdNhupR7JEfan11zGnBUFEb3Y=; h=X-UI-Sender-Class:Subject:To:Cc:References:From:Date:In-Reply-To; b=CllsU9O1SORENPpyYtO06MX/zs2qvJtWNme3Isi5Se1vyRA51OmlsQH+Iiznvf2ZA C2ogn82z025RM9ctYZDVrLX6RFGmiIs8I91F41fY5lAAF2lVvgwL+7ofWNOdtPiGLV 5uGL8QQFcj7x/pBO/NZkOFCls0oa11b/swp8ulV8=
X-UI-Sender-Class: 01bb95c1-4bf8-414a-932a-4f6e2808ef9c
Received: from [192.168.178.100] ([94.216.226.147]) by mail.gmx.com (mrgmx004 [212.227.17.190]) with ESMTPSA (Nemesis) id 1Mkpf3-1k5mCo396l-00mIuU; Fri, 30 Oct 2020 13:28:13 +0100
To: Eric Rescorla <ekr@rtfm.com>, Benjamin Kaduk <kaduk@mit.edu>
Cc: Watson Ladd <watsonbladd@gmail.com>, Joseph Salowey <joe@salowey.net>, "tls@ietf.org" <tls@ietf.org>, draft-ietf-tls-dtls-connection-id@ietf.org
References: <13a821d3-30cc-94b8-842c-22a87d280f09@gmx.net> <CACsn0cn4QcnaoocQeoiUXgGoAvfOs+1+Ei76z1Kuq8MMqNEh3Q@mail.gmail.com> <0327abb0-6317-b848-28d0-1fc50f4bf50e@gmx.net> <20201012200548.GD1212@kduck.mit.edu> <bab402e6-3353-d750-a849-21c91081f94e@gmx.net> <20201014212428.GP50845@kduck.mit.edu> <a7110178-6220-175e-869d-fcc44400f773@gmx.net> <CABcZeBNocUYZO9yxuG-DYh33ss+Dum1EOxHYEdww5OCR=rKFXw@mail.gmail.com> <20201024021316.GN39170@kduck.mit.edu> <CABcZeBPP_PFWtaNB4Wr+2MoY2+8Mh1Vxt9A-Hp5LaCg9DiLCFw@mail.gmail.com> <20201027010029.GG39170@kduck.mit.edu> <CABcZeBOQxpWMSuJiiXDB0Cf62iNU+hU8Wpd_Pd_1HOgXJYc0Kg@mail.gmail.com>
From: Achim Kraus <achimkraus@gmx.net>
Message-ID: <3e55d1fe-62b2-c62e-a085-032ecb43addb@gmx.net>
Date: Fri, 30 Oct 2020 13:28:12 +0100
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0
MIME-Version: 1.0
In-Reply-To: <CABcZeBOQxpWMSuJiiXDB0Cf62iNU+hU8Wpd_Pd_1HOgXJYc0Kg@mail.gmail.com>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Language: de-AT-frami
Content-Transfer-Encoding: quoted-printable
X-Provags-ID: V03:K1:mad3aQ2YZ80LpquFIBGyVMUHoqrByY7CjanVYiMeRN4LBlwrFLI k7Ns6kYyvlOxxOaM6VEUEZKbbFRFaMH6Z59dNowsDzsHInAF7IjqnaCH6ZuQp1glE1MyPz4 ul+hmkrY1Na6bedS9tnBfrvx5e5HPoyVB3316Tuzll5vUcflEwtucldfDS2cGZbh/9rO7w5 D13UD8pJb9Ie//DZ7XB4g==
X-UI-Out-Filterresults: notjunk:1;V03:K0:YVlZeE83lp0=:QSefrD9zZS9KAvQAkWYf14 K65Q84vlO4KloO/ZH7EtkOoeGMhKmXfQ7UWjYrHY6gMPNPSebkNFILB+b9FrfuMU76sBFmRrc pMQ2K9CLxiUm0frkjnPrFmMFDAfhPu6mI9eZQ06N3wKYwVztfDeklpuu2Ap9sAKu9C6kPeoMJ OM6xwQWSS/kki5ttqXbWngv8FIpiLX+LmdsoOedbdXO1ZYTi2uyPu2RHh59gIaNzv+5FfxdRZ xTm7Dtf/iGs6Kg+u+YqhrnumpdfHtYSx71hEoCSarYEhUtnhmUsPyeP2hWxHXwZW9MWXEv3bB MnjVFiO+P3/6B2+z3Zq8ijbSeWyLYKuKCOigAiJukrmZ94wMcY05x30gKzjxpkWo52zJl53aP kTJeY5pU3MQQHhQhWBY2R/WV7bIjXc5Ofa4J4v0Lpx/8oplyhikdfW3upxuS2iH17tk8hSYz7 1UXCWVnZQ49ndMZ9PbzcDOdxtqJ8r6Adnvuyo2wemDkPYN9WZl39vgsqxv4s7n4dOrdSNgT80 yLsBYBMMh21ywZbO7Yb6negSdqwySGF2OHTPzBqEqhgzkq+I5zJFXJMKsfzAjuEXd0t+uq/Cz uO3jSDmBwBF4od5m0vVo8wg3fsCfpTHHtFrxcT4cT83U5YOGZ0gO3EW8/AdBmSdj9Xr7WBYWg JT2248y/76C7a8Znqn2TYfmWOzLiDbcVGKzU4D510h8tW0XTr8EE5VLgPiRfS/j7whcURo9po gwo9TqQ4T5h+bD3mcq14NQVFE3AMMY+nAzgTlLGfWCsUd9b1wK/W+WMs6+WcU8QdESs3+vozn oC1KEqX49bO0wFZ+Ad4HsRUWqZ/eN5HkLSS5tmuVW06HwfWVXXhgmb2fbxpCeu+V0oXvXm2q7 HcrdAJw4S9rp5ZV6NL/A==
Archived-At: <https://mailarchive.ietf.org/arch/msg/tls/zN4AyZ02AcH4PcOs5xQ8Z1-xZ-4>
Subject: Re: [TLS] Fwd: Re: AD review of draft-ietf-tls-dtls-connection-id-07
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 30 Oct 2020 12:28:25 -0000

Hi Ekr,

> As for EtM
>
> Encrypt-then-MAC:
> struct {
>    uint8 marker = tls12_cid;
>    uint8 cid_len;
>    uint8 content_type = tls12_cid;      \
>    uint16 DTLSCiphertext.version;       |  appears on wire
>    uint64 seq_num; // includes epoch    |
>    opaque cid[cid_len];                 /
>    uint16 iv_length;
>    opaque IV[iv_length];
>    uint16 enc_content_length;
>    opaque enc_content[enc_content_length];
> };
>

I failed to understand the reasons behind this proposal.

1. Why should the "marker" be added, if the "content_type" is already in
the MAC, and this special MAC is only applied for tls12_cid records.
What is the intended benefit of that?

2. Why should a "uint16 iv_length" be added?
2.a If it should be added, why as "uint16" instead of "uint8"
2.b If it should be added, why in the middle? It's not on the wire and
so I would assume, if at all, to have that at the begin.

best regards
Achim Kraus