Subject: [TLS] Changes to draft-ietf-tls-dtls-heartbeat resulting from IESG review

From: Joe Salowey <[email-masked]>
Date: Sun, 4 Dec 2011 22:13:47 -0800

Some changes were made to the document as part of IESG review.  The revised document and diffs can be found here:

http://www.ietf.org/internet-drafts/draft-ietf-tls-dtls-heartbeat-04.txt

http://tools.ietf.org/rfcdiff?url2=draft-ietf-tls-dtls-heartbeat-04

One of the requested changes was to randomize to the data in the heartbeat message to attempt to head of any issues occurring from weak or flawed ciphers.   Since the change was relatively simple, the document was modified even though modern ciphers should not have a problem.  Flaws may be discovered in one of the many cipher suites in the future.  

Cheers,

Joe

---

From: Nikos Mavrogiannopoulos <[email-masked]>
Date: Mon, 5 Dec 2011 10:37:26 +0100

> One of the requested changes was to randomize to the data in the heartbeat message to attempt to head of any issues occurring from weak or flawed ciphers.   Since the change was relatively simple,…

Are there any papers or cipher documentation discussing how using
randomized data in a packet would solve possible future cipher flaws?

regards,
Nikos

---

From: "Dan Harkins" <[email-masked]>
Date: Mon, 5 Dec 2011 09:04:24 -0800 (PST)

On Mon, December 5, 2011 1:37 am, Nikos Mavrogiannopoulos wrote:
>> Some changes were made to the document as part of IESG review. Â The
>> revised document and diffs can be found here:
>> One of the requested changes was to randomize to the data in the
>> heartbeat message to attempt to head of any issues occurring from weak
>> or flawed ciphers. Â  Since the change was relatively simple, the
>> document was modified even though modern ciphers should not have a
>> problem. Â Flaws may be discovered in one of the many cipher suites in
>> the future.
>

  Check out "Deterministic Authenticated Encryption"* by Rogaway and
Shrimpton. It defines a cipher mode for key-wrapping but the proof of
security (appendix C) is based on the notion of randomized data in the
packet-- i.e. that part of the data (the key) being wrapped is random.

  They also treat this new cipher mode as a general IV-based authenticated
encryption scheme that has the property of misuse-resistance (section 7).

  regards,

  Dan.

 * http://www.cs.ucdavis.edu/~rogaway/papers/keywrap.pdf

---

From: Nikos Mavrogiannopoulos <[email-masked]>
Date: Tue, 6 Dec 2011 17:17:06 +0100

On Mon, Dec 5, 2011 at 6:04 PM, Dan Harkins <[email-masked]> wrote:

>>> or flawed ciphers.   Since the change was relatively simple, the
>>> problem.  Flaws may be discovered in one of the many cipher suites in
>>> the future.

Indeed, but this is not a generic encryption mode like CBC or CTR. It
is specifically designed to encrypt random keys, and thus depends on
its randomness. Typical encryption modes are specifically designed to
prevent someone distinguishing a given plaintext encryption from a
random one.

Now, if one would like to use a subliminal channel in TLS, the
heartbeat extension now provides an unbounded channel.

regards,
Nikos

---

From: "Dan Harkins" <[email-masked]>
Date: Tue, 6 Dec 2011 10:10:36 -0800 (PST)

On Tue, December 6, 2011 8:17 am, Nikos Mavrogiannopoulos wrote:
>> Â Check out "Deterministic Authenticated Encryption"* by Rogaway and

  Actually it is a generic encryption mode. It's a generic AEAD scheme
(like GCM or CCM) and has code-points allocated by IANA for AEAD
algorithms defined by RFC 5116:

http://www.iana.org/assignments/aead-parameters/aead-parameters.xml

Unlike other AEAD schemes this one has the benefit of misuse-resistance
(see section 7).

  It is also provably-secure key-wrapping scheme, as you note. I
mention this because it formally addresses the issue of randomness
in the packet and its effect on the security of the cipher mode which
is what I thought you were asking about.

  It's a generic AEAD mode...it's a key-wrapping scheme... for a
crypto protocol developer, it's the new SHIMMER!

http://www.nbc.com/saturday-night-live/video/shimmer-floor-wax/1056743/

> heartbeat extension now provides an unbounded channel.

  Well that's a whole different issue....

  Dan.