Subject: [TLS] draft-ietf-tls-renegotiation-01.txt and DTLS

From: Michael Tüxen <[email-masked]>
Date: Mon, 30 Nov 2009 18:38:41 +0100

Dear all,

I would like to get the relation of the RI Extension and DTLS clarified.

If I'm not wrong, then the attack which works against TLS does not
work against DTLS, since DTLS has an epoch counter.

If a client tries to establish a DTLS connection and a MITM intercepts
it, establishes itself a DTLS connection, the epoch is 1. There will be
a final mismatch in the epoch and the packets will be discarded. When
using the RI extension one could enforce the sending of the alert message.
But the original attack is not possible, I think.

Is my analysis correct or am I overlooking something?

If I'm right, is the alert worth using the RI also for DTLS?

Can we add a statement to draft-ietf-tls-renegotiation-01.txt clearly
stating that the RI MUST also be used for DTLS or MUST NOT be used.

Best regards
Michael

---

From: Marsh Ray <[email-masked]>
Date: Mon, 30 Nov 2009 12:06:02 -0600

> Is my analysis correct or am I overlooking something?

Can MitM do the same number of renegotitations as he does with the
server before splicing him?

- Marsh

---

From: Michael Tüxen <[email-masked]>
Date: Mon, 30 Nov 2009 19:23:22 +0100

> server before splicing him?
Good point, I missed that. So DTLS is also affected.

Could we then make it clear the that the RI extension applies to
TLS and DTLS?

Best regards
Michael

---

From: Eric Rescorla <[email-masked]>
Date: Mon, 30 Nov 2009 10:29:30 -0800

At Mon, 30 Nov 2009 12:06:02 -0600,
> server before splicing him?

Nagendray and I had this conversation last week. While I haven't done
a complete analysis, my intuition is that DTLS is more resistant (for
the reason you indicate) but not 100% resistant.  Another concern
would be epoch rollover: what if you do 65536 (65535?--too lazy to
calculate) handshakes with the server and force the epoch back to 0?

So, probably better to use RI with DTLS as well.

-Ekr

---

From: Eric Rescorla <[email-masked]>
Date: Mon, 30 Nov 2009 10:29:56 -0800

At Mon, 30 Nov 2009 19:23:22 +0100,
> Could we then make it clear the that the RI extension applies to

Yep. I'll add it to my TODO list.

-Ekr

---

From: Kyle Hamilton <[email-masked]>
Date: Mon, 30 Nov 2009 10:31:40 -0800

I would support randomizing the epoch counter in DTLS, giving a 1:2^16
chance of getting it right in a single attempt.  (This follows my
observation that the hash saved from the last Finished message is
essentially the same as a named epoch.)

-Kyle H

On Mon, Nov 30, 2009 at 10:29 AM, Eric Rescorla
<[email-masked]> wrote:
> _______________________________________________
> TLS mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/tls
>

---

From: Michael Tüxen <[email-masked]>
Date: Mon, 30 Nov 2009 20:39:01 +0100

> essentially the same as a named epoch.)
Who chooses the epoch randomly, how does the peer know this value?

Best regards
Michael