Subject: Re: [Cfrg] Stateful deterministic encryption

From: "Paterson, Kenny" <[email-masked]>
Date: Fri, 13 Jun 2014 13:59:19 +0000

Daniel,

Thanks for the positive comments on the paper (on which I am a co-author).

I'd encourage anyone who is thinking of looking at the paper to wait a
couple of days until we've made some small changes here and there to clean
up the presentation - we're nearly done.

One issue with the approach - which I hope is made very clear in the paper
itself - is that we are far from solving the whole problem. Indeed, there
are many ways to subvert a secure channel protocol other than those that
are captured in our model.

Cheers

Kenny

On 12/06/2014 20:25, "Dan Brown" <[email-masked]> wrote:

>Dear CFRG list,
> 
>I recommend reading the excellent report on subverted symmetric
>encryption.
> 
>http://eprint.iacr.org/2014/438
> 
>The report raises the potential vulnerability of implementations of
>various IETF protocols to subverted symmetric encryption attacks.  The
>report recommends various stateful deterministic symmetric modes.  Should
>CFRG
> encourage IETF to adopt these?
> 
>Many IETF protocols are already pretty close to using stateful and
>deterministic symmetric encryption, but still have potential subversion
>vulnerability arising from variable padding length being subvertible to
>leak the
> symmetric key.  
> 
>If I recall correctly, the purpose of variable message lengths is to hide
>the message length.  If so, then maybe it would be beneficial to derive
>the variable length deterministically from the key and state (and perhaps
> message, etc.) in a manner that achieves the unique-ciphertexts property
>describe in the report, and still continue to somewhat hide the message
>length.
> 
>Best regards,
> 
>Daniel Brown
>Research In Motion Limited
> 
> 
>
> 
>