Subject: [Unbearable] TLSUnique is only 96 bits. Is OK?

From: Bill Cox <[email-masked]>
Date: Mon, 31 Aug 2015 14:04:32 -0700

Sorry for bringing up another point that has already most likely been
discussed in depth.

The TLS unique value is 12 bytes of the hash of the first finish message.
This is good enough probably for second pre-image resistance, but too weak
for collision resistance.  For use in Token Binding, I have not been able
to come up with any realistic attack based on collisions.

The basic attack would be someone trying to use your auth cookie on a
machine/account that does not have access to the Token Binding private
key.  The attacker knows he needs to generate a signature of the TLS Unique
value which will be accepted by the server.  If he has your auth cookie, he
might also have been able to monitor previous traffic, and could have
collected a few thousand signed TLS Unique values.  He might also be able
to connect to the server a few thousand times trying to get a connection
with a TLS Unique that he has seen before.

Taking this attack to the extreme, suppose the attacker can cause the
original device to make SSL connections to the server, and can generate 1
billion TLS Unique signatures.  On the alternate device, he tries 1 billion
new connections, to see if he gets a collision.  The likelihood of such an
attack succeeding is about 1 in 100 billion.

I'm OK with these odds for this specific attack.  However, I would not want
people using the TLS Unique value for cryptographically binding other
things to the TLS channel parameters.  For example, I would not want credit
card transactions to use the unique TLS unique as unique transaction
identifier.  Have we made it clear that the TLS Unique value should be used
only in well understood cases, where collision resistance is not
particularly important?

Thanks,
Bill

---

From: Nico Williams <[email-masked]>
Date: Mon, 31 Aug 2015 21:38:59 -0500

On Monday, August 31, 2015, Bill Cox <[email-masked]> wrote:
> [...]

The use cases envisioned in RFC5056 are somewhat limited.  Uses of channel
bindings in new ways require additional analysis.  I'll have to refresh my
memory as to the token binding use...  But yes, if the threat model allows
the attacker to know the change binding and to attempt many connections
then yes, 96 bits behind to look short.

Nico
--