Subject: What I was talking about today

From: Eric Rescorla <[email-masked]>
Date: Thu, 20 Jul 2017 08:53:35 -0700

Here's the half-baked attack I was suggesting today.

Suppose we have a manipulation of packets that induces an immediate
response from the server, like if a recipient responds to an
out-of-order packet with an immediate ACK. The bit flipping thus
potentially allows an attacker to differentiate a *response* packet
from a packet which was organically generated by the other side
(by looking for the bit flip).

Now, suppose you *also* have a non constant time cryptographic
implementation. The manipulation above would allow an attacker to
partly measure the processing time for a given packet, which might
eventually let them learn information about the traffic keys.

I'll be the first to admit that this is a stretch:

- You need a broken implementation
- Even without this bit, you can take the same measurement
  because the next packet is most likely the response anyway,
  not organic.

However, you can imagine situations in which it just barely might
be a problem, such as when the receiver is generating synthetic
traffic for anti-traffic analysis (thus hiding responses in
organic traffic).

Like I said, this is pretty half-baked, but that's what you get
when I try to design attacks at the mic.

-Ekr