Subject: Re: [TLS] CCS and key reset and renegotiation

From: Peter Gutmann <[email-masked]>
Date: Fri, 6 Jun 2014 01:41:53 +0000

Watson Ladd <[email-masked]> writes:

>The spec needs a state machine.

No, it's this that created the problem in the first place.  SSL/TLS (and SSH,
and others) are best described using a ladder diagram (and in fact that's how
pretty much every diagram of the protocols that I've ever seen does them).
The fact that the spec dresses it up like a state machine means that anyone
who actually tries to implement it that way ends up vulnerable to mistakes
like the current OpenSSL one.  So the spec needs to take a protocol that
exists as a ladder diagram and describe it as such, not pretend that it's
meant to be a state machine.

Peter.

---

From: Watson Ladd <[email-masked]>
Date: Thu, 5 Jun 2014 19:59:08 -0700

> meant to be a state machine.

Because the Certificate, Certificate Request, ServerKeyExchange, and
some other messages in the handshake are optional, I don't see how a
ladder diagram can encapsulate the protocol. That's ignoring the fact
that you can send as much application data as you desire before
terminating the connection, so there is a branch: either we get app
data, or a termination.

To me a spec based on a state machine says in each state what all the
allowed transitions are, and what is emitted in each state, and what
drives the transitions.

Either way 5 out of 6 implementors got it right. It's not even a
barrier to formalization: what the protocol does is a much bigger
issue, and that's where I hope to send a lengthy email laying out what
TLS 1.3 should look like. (There is also another issue: X509 is
massively complicated and is the only certificate format TLS supports.
Perhaps we should consider lightweight alternatives)

Sincerely,
Watson Ladd

>
> Peter.
> _______________________________________________
> TLS mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/tls

-- 
"Those who would give up Essential Liberty to purchase a little
Temporary Safety deserve neither  Liberty nor Safety."
-- Benjamin Franklin