[Ufmrg] Comments on formal analysis of relay attacks in intra-handshake attestation (CVE-2026-33697)
rachid bouziane <exelogphp@gmail.com> Wed, 22 July 2026 10:56 UTC
Return-Path: <exelogphp@gmail.com>
X-Original-To: ufmrg@mail2.ietf.org
Delivered-To: ufmrg@mail2.ietf.org
Received: from localhost (localhost [127.0.0.1]) by mail2.ietf.org (Postfix) with ESMTP id 1F4FA11C2B205 for <ufmrg@mail2.ietf.org>; Wed, 22 Jul 2026 03:56:10 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ietf.org; s=ietf1; t=1784717770; bh=E2wJ3P68a+asd/H3CiYymMh7k6nkAqJYR+cyS2trVio=; h=From:Date:Subject:To; b=hzpTAisIzXPIOdGH3Tji/SCpKE/jYf19zzuCjsw+hwHNtftSYeMzIoiluwkCcIZ9F rlV4XXp2Ay8WRhndSX26BY+YauaDk70YNY0bQNVB4U7+KXTa1iZR3Mnp87lOQ2fQMf ZfhzhSySvtcQFZobJNDGaLoo43PXXtFkZ9SYWatQ=
X-Virus-Scanned: amavisd-new at ietf.org
X-Spam-Flag: NO
X-Spam-Score: -2.098
X-Spam-Level:
X-Spam-Status: No, score=-2.098 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: mail2.ietf.org (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com
Received: from mail2.ietf.org ([166.84.6.31]) by localhost (mail2.ietf.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0Q_fPVFxJYcX for <ufmrg@mail2.ietf.org>; Wed, 22 Jul 2026 03:56:09 -0700 (PDT)
Received: from mail-yx1-xb12d.google.com (mail-yx1-xb12d.google.com [IPv6:2607:f8b0:4864:20::b12d]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature ECDSA (P-256) server-digest SHA256) (No client certificate requested) by mail2.ietf.org (Postfix) with ESMTPS id 7DAAC11C2B12D for <ufmrg@irtf.org>; Wed, 22 Jul 2026 03:55:35 -0700 (PDT)
Received: by mail-yx1-xb12d.google.com with SMTP id 956f58d0204a3-66899fe9077so305377d50.1 for <ufmrg@irtf.org>; Wed, 22 Jul 2026 03:55:35 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; t=1784717729; cv=none; d=google.com; s=arc-20260327; b=PhQQ1rDMR16O/rdnfSXh5NQMzbmHUh2nELf7zOStywwwf75+OsxeaLsg4YbgdNygio IfTxLvLbnjgGrtTUYaoNMFPk8hqV4QOzuOpnntor/OfAKnxboUwYaPuTEMPIMRJJ87hj PVCMlTVcRyLXNd4DsZjwjB5Pu9qvowS7mYElcVS2pT0XYD6zR41iOmZl3z1gW0w6ktxc fI0901or+7yMxldiJTqWW+5C0AD362cxy/gfihekI/MjTDvdZoG350dFjCeUrMvALsAs dgED09anCSDMgVf3XjMyY5qhh3zgSf1p8FNse9GOn+bSLo1HojaohkRmVdkunZhzL7QV igjw==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=to:subject:message-id:date:from:mime-version:dkim-signature; bh=E2wJ3P68a+asd/H3CiYymMh7k6nkAqJYR+cyS2trVio=; fh=RoTl5ZwqxZ833hd3AhT5WMDsG7JGioRhGsOLS/YBsFw=; b=lwpAPIgOiNts8ubLQfZNfslkCW9Wypzx7zRrj0o0e0rRrZ69f4qrXiQJOLWUDnTTtI 4incbUgss5h1W5+wKF4rOl5uMq8CPXBFD0H1a9TIfvtvjslCSI7k6t4uNMfuMAE0BIFF 7IQ8R7Y2bbxfI86LfXhr/bGPXcJqnA4N0bJstYt/dJkB95DBnwaBLuAgMQM0MLsu2qoV 6swx86PNhWym7StCNPGGOEdBBXMp2Yt+YpfWNXcUJWd2Erni66IlEmnPQYBxPobKXmdv Eb2xVyslghe0aEyFzzvRbftt903DWvvfH458y68O01Dqy8MfYtIiH1IHD28m5dzjRqBz 3zmA==; darn=irtf.org
ARC-Authentication-Results: i=1; mx.google.com; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1784717729; x=1785322529; darn=irtf.org; h=content-type:to:subject:message-id:date:from:mime-version:from:to :cc:subject:date:message-id:reply-to:content-type; bh=E2wJ3P68a+asd/H3CiYymMh7k6nkAqJYR+cyS2trVio=; b=WviM2bHV4np4nDmJFvVoo4vrCLlbozNHrhPiwgWzGxtDhUW/UOEH1Q1lnTBjzGyOB5 BygjXar07wQXT6706S3c1ODwn+RONfD127ekU1JqmhnIpnz49ZCFFsWJiMOzgQ932kB3 lM2lyUJNLd1e0nljrLwNzDbuVFb0NtouhIT9eHfGNC8avwrk+B7ND9LfBWIZDRMhnI+o tef+owKXMJ7FFFHfFgiss4qOPE7SJ4oDVlDHpqCm09SeU2DYsf3c0Pf3cr1d6brfKivy U37gMBoOQgX8L5hqmIeSRgxAefYnztt60aIcB2HJk5NSnC6uw5CJO+CGuT1gPSkOx/Q0 o0aQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784717729; x=1785322529; h=content-type:to:subject:message-id:date:from:mime-version:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=E2wJ3P68a+asd/H3CiYymMh7k6nkAqJYR+cyS2trVio=; b=kv3crDGInr6J5ATMA4ka1ZEoQdiXS9WL2PbQrUq7RbOYJEWWnzOJMolQyFUPjxXfd3 /OGKT+/z632NDzAlXa5RcIAZoPHcDaZecAS3cjn/kVzy5YcZX3Q8l0mSyq+YeJly196Q iyjsqy7U3dBE/tdEzGBaduWa9s+08IAFVDlmI0tzTO6vfokWHBK/tZJublrOllIWBUVU 1/2Ag40pfbQp6hlVKxkxtzcwYi9d04wOYdvCm5KjQr2mVwLMuxf+Y0HpVeI2X+MKT/qD 2fsaAHDck1gujF0QrZrHI5/weBvTvrz4i9lGwzmAdKlrH/xEXQ464f1BBlxgV0eB/HM4 lg3Q==
X-Gm-Message-State: AOJu0Yy9viljUU81gxtIKy1nnzL+vnGKFmpuc8HWN9+NWBFg6WD6S907 mMlI93/h2rPNehaz6KwcE+SlCbQYR1z88L5XFmGY7XEs2iapPd6k2Uhqnss2qydnwUbV28ywN/C EBpw1Rn/LLd+Km9HIkiqAh4I9kmj91VVfTCA0
X-Gm-Gg: AR+sD11Z3n/eKkoVo1qujcKskRx1EjEhjTDDorBVobA3xqEn3q2EzsZoNLkk/PWiwmk Srmvh88zm5u1a+/5Z8t1cRWeMdE8FApjqdSCsav2Y8SMhLVvzhJekcNplD4ejFcxgypS5JhY9X7 AsAq3hIKk8mEcay49+RY4snHQRfCQiNKY0Z0mCQcufX8wAkABcPO44iq3WR3LDccaSlhQyXPufn Xpjz9mAEZxV/N5ex4XKZZW47WobtuQ4J2pdVSQkP7lmj6CefJ5ReUn4QF6X3QcSBav/ZApbO/MO 2NXB7U5mzG4dP9XmAbGVUldWqPilO3se+MLahD7VgmXR
X-Received: by 2002:a05:690e:43cd:b0:667:5ada:e413 with SMTP id 956f58d0204a3-6683bcdfe4amr3459895d50.67.1784717728955; Wed, 22 Jul 2026 03:55:28 -0700 (PDT)
MIME-Version: 1.0
From: rachid bouziane <exelogphp@gmail.com>
Date: Wed, 22 Jul 2026 12:55:17 +0200
X-Gm-Features: AUfX_mziO8fn4Qt8l4RIJR29IMOdu9dfj0kg2AwV88-O01V0QoxiVAoR6Q_e0fA
Message-ID: <CAHkvZnpaMCL-T3uusVAJ_Cr9ZdwCYMpCwA7KyZZCev8dPYnE0A@mail.gmail.com>
To: "ufmrg@irtf.org" <ufmrg@irtf.org>
Content-Type: multipart/alternative; boundary="000000000000424056065730fa7f"
Message-ID-Hash: GDFL6YZXCC3RJ7MMJQTQ44HMAQLIWDTP
X-Message-ID-Hash: GDFL6YZXCC3RJ7MMJQTQ44HMAQLIWDTP
X-MailFrom: exelogphp@gmail.com
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
X-Mailman-Version: 3.3.9rc6
Precedence: list
Subject: [Ufmrg] Comments on formal analysis of relay attacks in intra-handshake attestation (CVE-2026-33697)
List-Id: Usable Formal Methods Research Group <ufmrg.irtf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/ufmrg/29xFZX5C4oSGkpZAvXT_7YLW2Vc>
List-Archive: <https://mailarchive.ietf.org/arch/browse/ufmrg>
List-Help: <mailto:ufmrg-request@irtf.org?subject=help>
List-Owner: <mailto:ufmrg-owner@irtf.org>
List-Post: <mailto:ufmrg@irtf.org>
List-Subscribe: <mailto:ufmrg-join@irtf.org>
List-Unsubscribe: <mailto:ufmrg-leave@irtf.org>
Hi everyone, On reflection, I realize my earlier suggestion doesn’t actually apply here. The relay attack occurs before the TLS channel is established, and therefore before any HTTP layer exists at all — an HTTP-layer mechanism like mine can’t bind to a channel that doesn’t exist yet at that point in the handshake. Apologies for the noise, and thank you for the rigorous formal analysis. Best regards, Rachid
- [Ufmrg] Comments on formal analysis of relay atta… rachid bouziane