Subject: Re: [TLS] TLS1.3

From: Peter Gutmann <[email-masked]>
Date: Mon, 11 Feb 2013 23:13:41 +0000

[CC'd to Hugo Krawczyk, we really need another cryptographer in on this 
 alongside Kenny Paterson since the rest of us are mostly just guessing/
 speculating.  So the debate is about switching TLS to use encrypt-then-
 MAC from its current vulnerability-prone MAC-then-encrypt]

Martin Rex <[email-masked]> writes:

>But this sounds like your changing the semantics for all ciphersuites,
>including the GenericStreamCipher PDU, which includes ciphers such as 
>TLS_RSA_WITH_RC4_128_MD5, and AEAD ciphersuites.

OK, there are two more lines of code I didn't show (since they're in the 
calling function), the code there is something like:

switch( protection_type )
  case classic_SSL: wrapPacketSSL();
  case AEAD: wrapPacketAEAD();
  case encrypt_then_MAC: wrapPacketEthenM();

So it's really two lines added and two lines swapped (+syntactic sugar
and comments).  And several hundred lines of ad-hockery to deal with
MAC-then-encrypt vulnerabilities sidelined.

>I would really hate having to add a black-list of cipher suites that must 
>not be used with the new scheme (such as TLS_RSA_WITH_RC4_128_MD5) in a 
>few years, when it turns out that an HMAC-MD5 is too weak.

In what way would HMAC-MD5 be "too weak"?  I agree that HMAC-SHA1/
SHA256 are a better proposition, but using HMAC-MD5 should be up to
the implementer in any case. I've deprecated it for some years now, the
minimum I'll do is HMAC-SHA1.  It's not as if there's a shortage of suites
to choose from, and I've never found anything that does only -MD5 and
not -SHA1.

Peter.

---

From: Wan-Teh Chang <[email-masked]>
Date: Fri, 15 Feb 2013 16:10:04 -0800

> to choose from, and I've never found anything that does only -MD5 and

There are some websites that enable only one cipher suite:
TLS_RSA_WITH_RC4_128_MD5. You can find some examples in this Chromium
bug report: https://code.google.com/p/chromium/issues/detail?id=118330

Wan-Teh