Subject: Re: [Lurk] Cryptoanalysis of KeyLess SSL

From: Daniel Migault <[email-masked]>
Date: Tue, 2 May 2017 13:10:25 +0000

Thanks for posting this paper Dimitry. I went through the paper on my way to Chicago. It would be great people have a look at it and provide feed back regarding the current proposal for LURK. I will definitively revise the security consideration and clarify text according to this paper. An extended paper is also expected to be published.

Yours,
Daniel

From: Lurk [mailto:[email-masked]] On Behalf Of Dmitry Belyavsky
Sent: Friday, April 28, 2017 8:41 AM
To: LURK BoF <[email-masked]>
Subject: [Lurk] Cryptoanalysis of KeyLess SSL

Hello,

JFYI
http://epubs.surrey.ac.uk/813643/1/mainKeyless.pdf

--
SY, Dmitry Belyavsky

---

From: Daniel Kahn Gillmor <[email-masked]>
Date: Wed, 03 May 2017 12:44:49 -0400

> http://epubs.surrey.ac.uk/813643/1/mainKeyless.pdf

thanks for the link, Dmitry!  And thanks to the authors of the paper for
documenting these gaps in the keyless protocol.

I note that the authors of the paper include the following remarks:

    To fully protect clients’ privacy, we believe that clients should be
    made aware of proxying, so they can decide whether they want a
    faster but less secure connection to a CDN or a slower but more
    secure connection directly to the origin server.

It's not clear to me that such a change would actually provide better
protection of client privacy.  In particular, such an option could be
misused by operators of malicious networks or other would-be MiTM
attackers to force themselves into the channel that would otherwise be
opaque to them.

I hope that proposals like the one above will give thoughtful
consideration to the user experience for common clients.  For example,
what would such a notification look like in a web browser?  What would
be the common experience of the browser user?  What would the user's
likely behavior be?  would such a situation really "fully protect
clients' privacy" or would it provide yet another lever of control that
the network operator can exercise over the endpoints?

   --dkg

---

From: Martin Thomson <[email-masked]>
Date: Thu, 4 May 2017 10:40:12 +1000

> attackers to force themselves into the channel that would otherwise be

I agree with DKG here.  The business of security indications is
already challenging enough.  A more thorough analysis would be
required.