Subject: [TLS] Upload of draft-pironti-tls-length-hiding-00

From: Alfredo Pironti <[email-masked]>
Date: Thu, 7 Feb 2013 11:24:30 +0100

Dear all,

I uploaded a draft that explains how to correctly use extra padding in
TLS to effectively hide the plaintext length. The draft proposes an
extension where length-hiding padding can be used with any cipher.

Furthermore, by including the pad in the MAC computation, the proposed
extension fixes the notorious padding oracle attacks on TLS block
ciphers.

The proposed extension and length-hiding mechanism are implemented in
GnuTLS 3.1.7.

I look forward to your comments and suggestions!

Best regards,
Alfredo

---

From: Alfredo Pironti <[email-masked]>
Date: Thu, 7 Feb 2013 11:27:01 +0100

PS: The draft is available at:
http://tools.ietf.org/html/draft-pironti-tls-length-hiding-00

---

From: [email-masked] (Martin Rex)
Date: Tue, 12 Feb 2013 07:04:49 +0100 (CET)

> I look forward to your comments and suggestions!

Since TLS implementations will likely need to support interop
for the original ciphersuites and GenericBlockCipher, GenericStreamCipher
and GenericAEADCipher for many years to come, I would personally prefer
to keep the PDU changes to a minimum.

Is there any specific benefit or necessity for the padding to be inserted
before the plaintext, rather than directly trailing the plaintext?

-Martin

---

From: Nikos Mavrogiannopoulos <[email-masked]>
Date: Tue, 12 Feb 2013 09:33:49 +0100

> before the plaintext, rather than directly trailing the plaintext?

The main reason is that it is much easier to remove this padding using
the current TLS parsing methods (i.e. two bytes the length, and data
follow).

The alternative would be to put the two length bytes at the end and the
padding data would be just before that. That would require a custom
parser for that packet that isn't used anywhere in TLS.

regards,
Nikos