Subject: Re: [Cfrg] Help with the use of contexts

From: Yaron Sheffer <[email-masked]>
Date: Tue, 17 Jan 2017 13:31:07 +0200

> Domain separation for signed values is important and TLS already defines
> context strings for signature operations:
> https://tools.ietf.org/html/draft-ietf-tls-tls13-18#section-4.4.2
>
> The way that this is constructed (due to me) is generic for any signature
> scheme. (Basically just have the context string be NUL-terminated at the
> beginning of the signed message.)
>
> So for TLS I believe that the issue is already taken care of. It would also
> probably just add pain for implementers if the context string were to be
> duplicated as an input to the signature scheme where signature schemes
> support it.
>
>
> Cheers
>
> AGL

Hi Adam,

Wide industry adoption of TLS 1.2 took around 10 years. So IMO saying 
"this is solved in TLS 1.3" is not a good enough answer, if in the 
meantime we will continue to see cross-protocol and cross-TLS-version 
attacks.

Please note that the original post refers to "TLS 1.2 (and earlier)."

Thanks,
	Yaron

---

From: Adam Langley <[email-masked]>
Date: Tue, 17 Jan 2017 08:12:16 -0800

On Tue, Jan 17, 2017 at 3:31 AM, Yaron Sheffer <[email-masked]> wrote:
> Wide industry adoption of TLS 1.2 took around 10 years. So IMO saying "this
> is solved in TLS 1.3" is not a good enough answer, if in the meantime we
> will continue to see cross-protocol and cross-TLS-version attacks.

If there are such attacks then they'll continue to be a problem for
TLS 1.2 because only the Ed* schemes have the possibility of a context
string. For ECDSA and RSA, the context still needs to be included in
the signed message somehow. So TLS 1.2 needs a larger change than
wiring up the context inputs of the Ed* schemes if you want to protect
it anyway.

Cheers

AGL

-- 
Adam Langley [email-masked] https://www.imperialviolet.org

---

From: Yaron Sheffer <[email-masked]>
Date: Tue, 17 Jan 2017 23:41:54 +0200

> wiring up the context inputs of the Ed* schemes if you want to protect

Correct, but this would still eliminate cross-version attacks between 
TLS 1.3 and TLS <= 1.2, for Ed*. In other words, there is (incremental) 
value in adding context opportunistically.

Thanks,
	Yaron

---

From: Ilari Liusvaara <[email-masked]>
Date: Wed, 18 Jan 2017 01:22:52 +0200

On Tue, Jan 17, 2017 at 11:41:54PM +0200, Yaron Sheffer wrote:
> Correct, but this would still eliminate cross-version attacks between TLS
> 1.3 and TLS <= 1.2, for Ed*. In other words, there is (incremental) value in
> adding context opportunistically.

TLS 1.3 server/client signatures are designed to resist confusion to
SSL 3.0 - TLS 1.2 signatures[1] anyway..

[1] There's the confusion possibility with RSA key exchange, but one
really can't do much about that (other than banning all present RSA
keys, but that would be infeasible)..

-Ilari