Subject: Re: [TLS] Encrypt-then-MAC again (was Re: padding bug)

From: Peter Gutmann <[email-masked]>
Date: Thu, 5 Dec 2013 04:41:57 +0000

Martin Rex <[email-masked]> writes:

>Peter's proposal changes AtE to EtA, but does not currently address the 
>predictable IV for SSLv3 & TLSv1.0.  As it turns out, EtA will not protect 
>from BEAST, because it is "generically" secure only against decryption 
>oracles.  BEAST was exploiting an _encryption_ oracle.

The idea was to fix as much as possible with the least overhead possible.  In
my code I had to change four lines of code (exclusing the negotiate-EtA bits,
which mostly involve changing some lookup tables), which is about as low-
impact as you can get.  I can certainly add explicit-IV, but since you get
that in TLS 1.1 anyway it didn't seem like a good idea to start messing around
with other aspects of the protocol.

Peter.

---

From: Trevor Perrin <[email-masked]>
Date: Wed, 4 Dec 2013 21:51:35 -0800

I'd like to add a vote for Peter's draft, along with (I believe)
Wan-Teh, Robert Ransom, Juho Vähä-Herttua, and others.

Some small objections have been raised which I believe can be countered:

 * Nikos prefers Mac-then-Encrypt over the reverse, but otherwise
supports this. [1]

 * Adam Langley has "no objection" to this, but prefers to focus on
AES-GCM and ChaCha20 [2].  Browsers are very concerned with speed, so
it's not surprising they prefer CTR-and-polynomial-MAC ciphersuites.
However, TLS is used places besides the browser, and I suspect many of
the smaller TLS libraries (such as those by Nikos, Peter, or myself)
would prefer smaller code changes.  Also, Peter's draft easily
upgrades security for all versions of TLS, and less-common
ciphersuites like TLS-SRP and TLS-PSK.

Trevor

[1] http://www.ietf.org/mail-archive/web/tls/current/msg10736.html
[2] http://www.ietf.org/mail-archive/web/tls/current/msg09826.html

---

From: Watson Ladd <[email-masked]>
Date: Wed, 4 Dec 2013 21:53:36 -0800

> ciphersuites like TLS-SRP and TLS-PSK.
AGL's opposition was mine, but given the reasoning Trevor presents I
would like to put my
vote behind Peter's draft.
> _______________________________________________
> TLS mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/tls

-- 
"Those who would give up Essential Liberty to purchase a little
Temporary Safety deserve neither  Liberty nor Safety."
-- Benjamin Franklin