Subject: [TLS] I-D Action: draft-ietf-tls-session-hash-02.txt

From: [email-masked]
Date: Mon, 06 Oct 2014 06:16:25 -0700

A New Internet-Draft is available from the on-line Internet-Drafts directories.
 This draft is a work item of the Transport Layer Security Working Group of the IETF.

        Title           : Transport Layer Security (TLS) Session Hash and Extended Master Secret Extension
        Authors         : Karthikeyan Bhargavan
                          Antoine Delignat-Lavaud
                          Alfredo Pironti
                          Adam Langley
                          Marsh Ray
	Filename        : draft-ietf-tls-session-hash-02.txt
	Pages           : 9
	Date            : 2014-10-06

Abstract:
   The Transport Layer Security (TLS) master secret is not
   cryptographically bound to important session parameters such as the
   client and server identities.  Consequently, it is possible for an
   active attacker to set up two sessions, one with a client and another
   with a server, such that the master secrets on the two sessions are
   the same.  Thereafter, any mechanism that relies on the master secret
   for authentication, including session resumption, becomes vulnerable
   to a man-in-the-middle attack, where the attacker can simply forward
   messages back and forth between the client and server.  This
   specification defines a TLS extension that contextually binds the
   master secret to a log of the full handshake that computes it, thus
   preventing such attacks.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-tls-session-hash/

There's also a htmlized version available at:
http://tools.ietf.org/html/draft-ietf-tls-session-hash-02

A diff from the previous version is available at:
http://www.ietf.org/rfcdiff?url2=draft-ietf-tls-session-hash-02

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: Alfredo Pironti <[email-masked]>
Date: Mon, 6 Oct 2014 15:27:18 +0200

Dear list,

I've updated the extended master secret draft according to your feedback.
In particular, I've clarified
- computation of the extended master secret for the TLS and SSL 3.0
protocols
- differences between the extended master secret computation and the
original one
The draft now uses 23 as the IANA assigned extension number.

We've set up a test server, available at mitls.org:2443. The running
implementation is miTLS, with experimental support for the extended master
secret extension.

Best,
Alfredo

On Mon, Oct 6, 2014 at 3:16 PM, <[email-masked]> wrote:

> _______________________________________________
> TLS mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/tls
>

---

From: Manuel Pégourié-Gonnard <[email-masked]>
Date: Mon, 20 Oct 2014 21:08:31 +0200

Hi,

> implementation is miTLS, with experimental support for the extended master
Thanks! I just had a go at implementing it, and interop with your test server
works fine for TLS 1.2 down to 1.0 included, but fails for SSL 3.0 (server
rejects Finished with bad_record_mac, most likely we didn't compute the MS in
the same way).

It may very well be a stupid mistake on my side, since I'm getting a bit tired
now, but I thought I'd just check with you if the test server is implementing
the latest (02) version of the draft for SSLv3, just to be sure.

Thanks,
Manuel.

PS: I noted a typo in section 4.2: "SSL 3.0 does not defne a PRF function" defne
-> define. Also, arguably "function" is redundant after PRF.