Subject: Re: [TLS] padding bug

From: "Lewis, Nick" <[email-masked]>
Date: Wed, 25 Sep 2013 09:32:57 +0100

Martin Rex wrote:
> Where I agree is that it would be preferable to limit any fix to the exact
> problem that has been identified (already by Vaudenay), which is in how
> SSLv3&TLS use a Blockcipher in CBC mode with "authenticate-pad-encrypt"
> rather than "pad-authenticate-encrypt".

I agree that the fix should be limited to the exact problem. The fix could be a change from AtPtE to PtAtE
using a greatly simplified version of http://tools.ietf.org/html/draft-pironti-tls-length-hiding-00  without
the length hiding features

--

________________________________
The details of this company are as follows:
G4S Technology Limited, Registered Office: Challenge House, International Drive, Tewkesbury, Gloucestershire GL20 8UQ, Registered in England No. 2382338.

This communication may contain information which is confidential, personal and/or privileged.

It is for the exclusive use of the intended recipient(s).
If you are not the intended recipient(s), please note that any distribution, forwarding, copying or use of this communication or the information in it is strictly prohibited.

Any personal views expressed in this e-mail are those of the individual sender and the company does not endorse or accept responsibility for them.

Prior to taking any action based upon this e-mail message, you should seek appropriate confirmation of its authenticity.

This e-mail has been scanned for all viruses by MessageLabs.

---

From: Alfredo Pironti <[email-masked]>
Date: Wed, 25 Sep 2013 12:48:55 +0200

On Wed, Sep 25, 2013 at 10:32 AM, Lewis, Nick <[email-masked]> wrote:
> using a greatly simplified version of
> http://tools.ietf.org/html/draft-pironti-tls-length-hiding-00  without

Indeed, I confirm a strict subset of
http://tools.ietf.org/html/draft-pironti-tls-length-hiding-02
(pointing to the latest version)
fixes the padding bug.

Once the padding bug is fixed according to this draft, my experience
implementing it in GnuTLS and miTLS is that it costs almost nothing to
implement the length-hiding features for the remaining stream and AEAD
ciphers.

Best,
Alfredo

> G4S Technology Limited, Registered Office: Challenge House, International
> Drive, Tewkesbury, Gloucestershire GL20 8UQ, Registered in England No.
> 2382338.
>
> If you are not the intended recipient(s), please note that any distribution,
> forwarding, copying or use of this communication or the information in it is
> strictly prohibited.
>
> Any personal views expressed in this e-mail are those of the individual
> sender and the company does not endorse or accept responsibility for them.
>
> Prior to taking any action based upon this e-mail message, you should seek
> appropriate confirmation of its authenticity.
>
> _______________________________________________
> TLS mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/tls
>