Subject: [TLS] Keeping TLS extension points working

From: David Benjamin <[email-masked]>
Date: Mon, 25 Jul 2016 22:32:29 +0000

Hi folks,

I'm not sure how this process usually works, but I would like to reserve a
bunch of values in the TLS registries to as part of an idea to keep our
extension points working. Here's an I-D:
https://tools.ietf.org/html/draft-davidben-tls-grease-00

(The name GREASE is in honor of AGL's rusted vs. well-oiled joints analogy
from https://www.imperialviolet.org/2016/05/16/agility.html )

One problem we repeatedly run into is servers failing to implement TLS's
various extension points correctly. The most obvious being version
intolerance. When we deployed X25519 in Chrome, we discovered an intolerant
implementation. (Thankfully it was rare enough to not warrant a fallback or
revert!) It appears that signature algorithms maybe also be gathering rust.
Ciphers and extensions seem to have held up, but I would like to ensure
they stay that way.

The root problem here is these broken servers interoperate fine with
clients at the time they are deployed. It is only after new values get
defined do we notice, by which time it is too late.

I would like to fix this by reserving a few values in our registries so
that clients may advertise random ones and regularly exercise these
codepaths in servers. If enough of the client base does this, we can turn a
large class of tomorrow's interop failures into today's interop failures.
This is important because an bug will not thrive in the ecosystem if it
does not work against the current deployment.

If you were in Berlin, you may recognize this idea from the version
negotiation debate. Alas that all happened in the wrong order as I hadn't
written this up yet. This idea can't be applied to versioning without
giving up on ClientHello.version, but we can start with the rest of the
protocol.

David

PS: This is actually my first I-D, so apologies if I've messed it up
somewhere!

---

From: David Benjamin <[email-masked]>
Date: Mon, 25 Jul 2016 22:35:37 +0000

On Mon, Jul 25, 2016 at 6:32 PM David Benjamin <[email-masked]>
wrote:

> revert!)

Er, I lost a sentence here, sorry.

I meant that, in addition to version intolerance other extension points
have also gathered rust. The X25519 trouble was an example of named curve
intolerance, not version. (Someone forgot a default in their switch-case.)

> It appears that signature algorithms maybe also be gathering rust. Ciphers
> and extensions seem to have held up, but I would like to ensure they stay
> that way.
>

---

From: Viktor Dukhovni <[email-masked]>
Date: Mon, 25 Jul 2016 23:23:07 +0000

> https://tools.ietf.org/html/draft-davidben-tls-grease-00

To really make this work, it would be necessary to expand the
reserved pool gradually, rather than all at once, so that servers
can't hard-code just the initially reserved pool, and still fail
with new "real" extensions later.  Add a new code point every year
for 5-10 years, and eventually servers will have extension tolerance.

-- 
	Viktor.

---

From: David Benjamin <[email-masked]>
Date: Mon, 25 Jul 2016 23:32:41 +0000

On Mon, Jul 25, 2016 at 7:23 PM Viktor Dukhovni <[email-masked]>
wrote:

> with new "real" extensions later.

My hope is that, especially with the values allocated sparsely, after
getting interop failure once or twice from unknown values, the servers will
quickly figure it out. I'm assuming the implementations simply made
mistakes or weren't paying enough attention to the specification rather
than being actively malicious.

But, you are right, one failure mode here is implementations may
"accidentally" hard-code the reserved pool... somehow.

> Add a new code point every year

To clarify, this is about making sure new implementations don't ossify the
whatever set of named groups (etc.) they observe, not flushing intolerance
out of existing ones. For existing ones, it'd be equally difficult to
deploy, say, GREASE for named groups as it'd be to deploy a new named group
to begin with. (Fortunately, we successfully deployed a new named group
just this year, so this is the perfect time to do that.)

David

---

From: Hubert Kario <[email-masked]>
Date: Tue, 26 Jul 2016 12:56:12 +0200

> does not work against the current deployment.

What prevents an implementation from ignoring values from just those reserved 
ranges and continuing to be intolerant to other values? After all, if they are 
reserved for this, they just need to ignore those values (as no "real" 
extension/value will ever use them) to "resolve the problem".

-- 
Regards,
Hubert Kario
Senior Quality Engineer, QE BaseOS Security team
Web: www.cz.redhat.com
Red Hat Czech s.r.o., Purkyňova 99/71, 612 45, Brno, Czech Republic

---

From: David Benjamin <[email-masked]>
Date: Tue, 26 Jul 2016 11:03:39 +0000

> extension/value will ever use them) to "resolve the problem".

Nothing. Just as nothing prevents an implementation from taking every
ClientHello current browsers send (variable parts like client_random
normalized), hard-coding their SHA-256 hashes, and rejecting anything that
doesn't match.

The point is to catch honest mistakes, not to avoid servers that are
maliciously trying to mess up the ecosystem.

We can certainly increase the pool over time as Viktor suggested if
special-casing these becomes a problem. I don't expect it to be, but we'll
see. Whereas not ignoring unknown values has empirically been a problem.

David

---

From: Hubert Kario <[email-masked]>
Date: Tue, 26 Jul 2016 13:20:04 +0200

On Monday, 25 July 2016 23:32:41 CEST David Benjamin wrote:
> > > I'm not sure how this process usually works, but I would like to reserve
> > 
> > a
> > 

Then we have "pet-projects" of which the primary/only developer walks away/
changes jobs well after it was tightly integrated with already deployed 
systems, code that is passed over to interns as nobody either has time, 
inclination or knows much about <insert main subject matter here> anyway[1]...

Thus I don't think it solves the problem even for non malicious programmers

While the idea of code points that MUST NOT be negotiated by servers is not 
bad one from testing perspective, we already have few values like this 
(0x00,0x14 for cipher, 15 for supported groups, just of the top of my head). 
And for a test suite any value not defined by IANA already has this function 
(and you do need to test all those values to search for undocumented features, 
backdoors, etc. anyway).

 1 - talking purely hypothetically here, even if I wanted, I wouldn't know 
where to point fingers in realm of TLS implementations
-- 
Regards,
Hubert Kario
Senior Quality Engineer, QE BaseOS Security team
Web: www.cz.redhat.com
Red Hat Czech s.r.o., Purkyňova 99/71, 612 45, Brno, Czech Republic

---

From: Sean Turner <[email-masked]>
Date: Tue, 26 Jul 2016 10:52:46 -0400

David,

Technically, IANA makes the assignments we (the IETF/TLS WG) ask them to make via the IANA considerations section.  They enforce the registry policy established when we (the IETF/TLS WG) originally established the registry; the available policies are found in RFC 5226 (and there’s some more rules in RFC 7120).  So, I’m hoping that you could tweak your draft somewhat to be instructional and then suggest some values (this purely procedural dance has worked in the past and it’s what we’re doing for draft-ietf-tls-ecdhe-psk-aead):

0) In s2, replace the two lists with something like:

The draft reservers the following X cipher suite values: Values TBD

The following X values are reserved as both GREASE extension values and GREASE named group values: Values TBD

1) In 5, add a {TBD} sub-column to the 1st column for each value in the tables (apologies for the formatting):

+-------------------------+-------------+---------+-----------------+
|    Value                   | Description | DTLS-OK |    Reference    |
+-------------------------+-------------+---------+-----------------+
| {TBD} {0x0A,0x0A} |   Reserved  |    Y    | (this document) |

And then add something like this to the end of the section:

  The cipher suite numbers listed in the second column in the
  values column are numbers used for cipher suite interoperability
  testing and it's suggested that IANA use these values for assignment.

I’m sure somebody will eventually comment on the following header fields:

0) “Status: Informational” because some of the registries right now require standards track RFCs to do the assignments.  But, everybody should momentarily suspend reality because we’re going to change the registry rules for the registries you are adding values you to be something that would allow an draft intended for “informational” to do the updates, i.e., just leave it alone for now.

1) “Updates: 5246 (if approved)” because typically extension documents don’t “update” the base specification.  If you are suggesting that all implementations must support these values then an updates header makes sense.  Note I’m sure somewhere along the way an extension that isn’t expected to be supported by all implementation has an updates header but what I described is how we’re doing it now.

Cheers,

spt

PS: As chair, I try to deal with/deflect as many of these procedural issues as possible, but if you want to know more please let me know off-list.  This actually goes for anybody on the list.

> On Jul 25, 2016, at 18:32, David Benjamin <[email-masked]> wrote:
> 
> Hi folks,
> 
> I'm not sure how this process usually works, but I would like to reserve a bunch of values in the TLS registries to as part of an idea to keep our extension points working. Here's an I-D:
> (The name GREASE is in honor of AGL's rusted vs. well-oiled joints analogy from https://www.imperialviolet.org/2016/05/16/agility.html )
> 
> One problem we repeatedly run into is servers failing to implement TLS's various extension points correctly. The most obvious being version intolerance. When we deployed X25519 in Chrome, we discovered an intolerant implementation. (Thankfully it was rare enough to not warrant a fallback or revert!) It appears that signature algorithms maybe also be gathering rust. Ciphers and extensions seem to have held up, but I would like to ensure they stay that way.
> 
> The root problem here is these broken servers interoperate fine with clients at the time they are deployed. It is only after new values get defined do we notice, by which time it is too late.
> 
> I would like to fix this by reserving a few values in our registries so that clients may advertise random ones and regularly exercise these codepaths in servers. If enough of the client base does this, we can turn a large class of tomorrow's interop failures into today's interop failures. This is important because an bug will not thrive in the ecosystem if it does not work against the current deployment.
> 
> If you were in Berlin, you may recognize this idea from the version negotiation debate. Alas that all happened in the wrong order as I hadn't written this up yet. This idea can't be applied to versioning without giving up on ClientHello.version, but we can start with the rest of the protocol.
> 
> David
> 
> PS: This is actually my first I-D, so apologies if I've messed it up somewhere!
> _______________________________________________
> TLS mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/tls

---

From: David Benjamin <[email-masked]>
Date: Tue, 26 Jul 2016 15:11:40 +0000

On Tue, Jul 26, 2016 at 10:52 AM Sean Turner <[email-masked]> wrote:

> David,
>
> Technically, IANA makes the assignments we (the IETF/TLS WG) ask them to
> make via the IANA considerations section.  They enforce the registry policy
> established when we (the IETF/TLS WG) originally established the registry;
> the available policies are found in RFC 5226 (and there’s some more rules
> in RFC 7120).  So, I’m hoping that you could tweak your draft somewhat to
> be instructional and then suggest some values (this purely procedural dance
> has worked in the past and it’s what we’re doing for
> draft-ietf-tls-ecdhe-psk-aead):
>

Got it. Will switch things to TBD. Thanks!

> 0) “Status: Informational” because some of the registries right now
> require standards track RFCs to do the assignments.  But, everybody should
> momentarily suspend reality because we’re going to change the registry
> rules for the registries you are adding values you to be something that
> would allow an draft intended for “informational” to do the updates, i.e.,
> just leave it alone for now.
>

Oh, this wasn't a conscious decision. I actually didn't even notice that
was a field to set. I just ended up with whatever defaults the template I
was using picked. Like I said, I'm new to this game. :-)

Pending registry rule change aside, is "Informational" correct for this
sort of thing or should I switch it?

> 1) “Updates: 5246 (if approved)” because typically extension documents
> don’t “update” the base specification.  If you are suggesting that all
> implementations must support these values then an updates header makes
> sense.  Note I’m sure somewhere along the way an extension that isn’t
> expected to be supported by all implementation has an updates header but
> what I described is how we’re doing it now.
>

I wasn't sure and mimicked RFC 7507 and RFC 7685 which both did this.

I expect that all servers will "support" this specification in so far as it
says nothing useful for servers. TLS servers are supposed to ignore unknown
values. I would certainly like for as many clients to do it as possible so
the ecosystem effects work out, but I certainly don't intend for it to be
any kind of requirement. (I suppose the text says MAY so existing clients
also "support" it by default.)

Is it better to remove that line in this case? Happy to do whatever works.

> Cheers,
>
> spt
>
> PS: As chair, I try to deal with/deflect as many of these procedural
> issues as possible, but if you want to know more please let me know
> off-list.  This actually goes for anybody on the list.
>
>

> a bunch of values in the TLS registries to as part of an idea to keep our
> > (The name GREASE is in honor of AGL's rusted vs. well-oiled joints
> analogy from https://www.imperialviolet.org/2016/05/16/agility.html )
> >

---

From: Wan-Teh Chang <[email-masked]>
Date: Wed, 27 Jul 2016 09:50:18 -0700

On Mon, Jul 25, 2016 at 3:32 PM, David Benjamin <[email-masked]> wrote:
> Ciphers and extensions seem to have held up, but I would like to ensure they
> stay that way.
>
> The root problem here is these broken servers interoperate fine with clients
> at the time they are deployed. It is only after new values get defined do we
> notice, by which time it is too late.
>
> I would like to fix this by reserving a few values in our registries so that
> clients may advertise random ones and regularly exercise these codepaths in
> servers. If enough of the client base does this, we can turn a large class
> of tomorrow's interop failures into today's interop failures. This is
> important because an bug will not thrive in the ecosystem if it does not
> work against the current deployment.

Hi David,

In general I like your idea. Thank you for writing up a proposal.

Another source of interop failures is the firewall devices that do
anomaly detection. Some of them will abort TLS handshakes if they see
unknown TLS protocol versions or extensions in ClientHello. (They all
seem to allow unknown cipher suite values.) I suspect they will treat
the GREASE cipher suite, extension, and named group values as "normal"
and continue to abort the handshake if they see truly new values. I
can only hope that these network security devices are updated
regularly.

Wan-Teh Chang

---

From: Adam Langley <[email-masked]>
Date: Wed, 27 Jul 2016 12:41:06 -0700

> can only hope that these network security devices are updated

Sadly there's very little that we can do to address aggressively bad
devices. None the less, there are several instances of unintentional
bugs in implementations that have caused problems with new-feature
deployment that I believe could have been caught with this proposal.
As ever, bugs are much less costly when found earlier and I believe
that applies equally to the developer and the world as a whole.

I have mind the cases of extension intolerance that we've thankfully
mostly managed to drive out now (because new extensions have been
added for other reasons) and the bug that led to the padding extension
(RFC 7685).

On the other hand, we've seen what's happened to the version field,
which is moving too slowly to resist rusting.

Cheers

AGL

-- 
Adam Langley [email-masked] https://www.imperialviolet.org

---

From: Sean Turner <[email-masked]>
Date: Wed, 27 Jul 2016 16:02:02 -0400

> On Jul 26, 2016, at 11:11, David Benjamin <[email-masked]> wrote:
> 
> I expect that all servers will "support" this specification in so far as it says nothing useful for servers. TLS servers are supposed to ignore unknown values. I would certainly like for as many clients to do it as possible so the ecosystem effects work out, but I certainly don't intend for it to be any kind of requirement. (I suppose the text says MAY so existing clients also "support" it by default.)
> 

I’d probably lean towards removing it.

spt

---

From: Hubert Kario <[email-masked]>
Date: Thu, 28 Jul 2016 12:28:52 +0200

On Wednesday, 27 July 2016 09:50:18 CEST Wan-Teh Chang wrote:
> > codepaths in servers. If enough of the client base does this, we can turn
> > a large class of tomorrow's interop failures into today's interop
> > failures. This is important because an bug will not thrive in the
> > ecosystem if it does not work against the current deployment.
> 
> Hi David,
> 

how about adding a section that explicitly says what they are allowed to do, 
and what they should not do?

i.e. it is acceptable for them to reject messages that are malformed (data in 
client hello past extensions field, odd sizes for arrays that contain just 
double-byte values, etc.) but not "undefined" extensions or "undefined" values 
in them

in other words, how they can still provide added value without breaking TLS in 
the future
-- 
Regards,
Hubert Kario
Senior Quality Engineer, QE BaseOS Security team
Web: www.cz.redhat.com
Red Hat Czech s.r.o., Purkyňova 99/71, 612 45, Brno, Czech Republic

---

From: Watson Ladd <[email-masked]>
Date: Thu, 28 Jul 2016 06:12:48 -0700

> double-byte values, etc.) but not "undefined" extensions or "undefined" values

This is what parsing is for.

> in other words, how they can still provide added value without breaking TLS in

Maybe they can't, and you shouldn't buy those products.

-- 
"Man is born free, but everywhere he is in chains".
--Rousseau.

---

From: Hubert Kario <[email-masked]>
Date: Thu, 28 Jul 2016 16:59:41 +0200

On Thursday, 28 July 2016 06:12:48 CEST Watson Ladd wrote:
> >> On Mon, Jul 25, 2016 at 3:32 PM, David Benjamin <[email-masked]>
> > 
> > wrote:
> >> > Hi folks,
> >> > 
> >> > analogy
> >> > implementation. (Thankfully it was rare enough to not warrant a
> >> > fallback
> >> > or
> > how about adding a section that explicitly says what they are allowed to
> > do, and what they should not do?
> > 
> > i.e. it is acceptable for them to reject messages that are malformed (data
> > in client hello past extensions field, odd sizes for arrays that contain
> > just double-byte values, etc.) but not "undefined" extensions or
> > "undefined" values in them
> 

yes, and bugs in parsing may very well be exploitable
 
> > in other words, how they can still provide added value without breaking
> > TLS in the future
> 

pragmatist would say that double checking is defence in depth

and whatever we think, doesn't change the fact that people do make them 
because people do buy them, so at least we can tell them how they can play 
nice

---

From: Geoffrey Keating <[email-masked]>
Date: 28 Jul 2016 11:01:39 -0700

Hubert Kario <[email-masked]> writes:

> > >> anomaly detection.

I don't think 'playing nice' is the point of these devices; the
concept is that unusual is bad, and so should be blocked.  They don't
just block new or unknown features, but sometimes also known features
being used in unusual combinations.  I've seen these devices raise a
security alert because of a ciphersuite list which contained only
ciphersuites used by browsers, but not in the expected
combination/order---at least, that's what I think it was.