Subject: Re: [TLS] Encrypt-then-MAC again (was Re: padding bug)

From: Peter Gutmann <[email-masked]>
Date: Thu, 5 Dec 2013 05:06:13 +0000

Martin Rex <[email-masked]> writes:

>I'm from the "don't-fix-it-if-it-ain't-broken" camp. And the less code needs 
>to be changed to adopt some useful feature, the more likely you will see it 
>being adopted for patches/maintenance. I have seen *ZERO* compelling reason 
>for switching to encrypt-then-mac in TLS. 

Uhh... what?  How have you missed ten years of attacks on TLS that take 
advantage of MtE?

Peter.

---

From: [email-masked] (Martin Rex)
Date: Thu, 5 Dec 2013 07:06:21 +0100 (CET)

> Uhh... what?  How have you missed ten years of attacks on TLS that take 

TLS using pad-mac-encrypt is proven secure and that mac-pad-encrypt
is a going to provide an attack surface was clearly pointed out by 
Serge Vaudenay in 2001.

This could have been fixed in TLSv1.1 (2006), but was ignored.
The attacks that were demonstrated were in the ballpark of what
was predicted in 2001.

The fragility of GCM worries me personally much more than the
attack surface of mac-pad-encrypt, e.g.

  Cycling Attacks on GCM, GHASH and Other Polynomial MACs and Hashes
  Markku-Juhani O. Saarinen
  http://eprint.iacr.org/2011/202.pdf

-Martin

---

From: Watson Ladd <[email-masked]>
Date: Thu, 5 Dec 2013 08:15:50 -0800

On Wed, Dec 4, 2013 at 10:06 PM, Martin Rex <[email-masked]> wrote:
<snip>
>   http://eprint.iacr.org/2011/202.pdf
What on earth convinced you this paper presented an interesting
result? Why is this forgery more
interesting than all the other forgeries? If you had bothered to do
more research you would see that in the
GCM standardization process this came up, and was appropriately
responded to with "that doesn't change
the security claim, and isn't interesting at all" (paraphrasing).
Mac-pad-encrypt reveals plaintext data. The above doesn't do anything
because if you pick a key uniformly at
random the probability a forgery succeeds is the probability q(x) has
a root at k, which is bounded by things like
being in a field. (Figure it out as an exercise in elementary algebra)
It doesn't matter what form q(x) has.
If you think the above is more worrying than mac-pad-encrypt, you
shouldn't be commenting on cryptography.
Sincerely,
Watson Ladd
>
>
> -Martin
> _______________________________________________
> TLS mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/tls

-- 
"Those who would give up Essential Liberty to purchase a little
Temporary Safety deserve neither  Liberty nor Safety."
-- Benjamin Franklin