Subject: [Uta] Fwd: New Version Notification for draft-ietf-uta-tls-attacks-02.txt

From: Yaron Sheffer <[email-masked]>
Date: Tue, 12 Aug 2014 23:55:09 +0300

Dear UTA folks,

This version incorporates feedback from shortly before, during and 
following the Toronto meeting. The changes are:

    o  Added implementation issues ("most dangerous code"),
       renegotiation, triple handshake.

    o  Added text re: mitigation of Lucky13.

    o  Added applicability to DTLS.

Please review and comment on the list.

Thanks,
	Yaron

-------- Forwarded Message --------
Subject: New Version Notification for draft-ietf-uta-tls-attacks-02.txt
Date: Tue, 12 Aug 2014 04:25:18 -0700
From: [email-masked]
To: Yaron Sheffer <[email-masked]>, Ralph Holz 
<[email-masked]>, Peter Saint-Andre <[email-masked]>, Ralph Holz 
<[email-masked]>, Peter Saint-Andre <[email-masked]>, Yaron Sheffer 
<[email-masked]>

A new version of I-D, draft-ietf-uta-tls-attacks-02.txt
has been successfully submitted by Yaron Sheffer and posted to the
IETF repository.

Name:		draft-ietf-uta-tls-attacks
Revision:	02
Title:		Summarizing Current Attacks on TLS and DTLS
Document date:	2014-08-12
Group:		uta
Pages:		10
URL: 
http://www.ietf.org/internet-drafts/draft-ietf-uta-tls-attacks-02.txt
Status:         https://datatracker.ietf.org/doc/draft-ietf-uta-tls-attacks/
Htmlized:       http://tools.ietf.org/html/draft-ietf-uta-tls-attacks-02
Diff: 
http://www.ietf.org/rfcdiff?url2=draft-ietf-uta-tls-attacks-02

Abstract:
    Over the last few years there have been several serious attacks on
    TLS, including attacks on its most commonly used ciphers and modes of
    operation.  This document summarizes these attacks, with the goal of
    motivating generic and protocol-specific recommendations on the usage
    of TLS and DTLS.

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

The IETF Secretariat

---

From: Will Sargent <[email-masked]>
Date: Wed, 13 Aug 2014 10:30:24 -0700

There's a typo on "Triple Hanshake" and "the are" instead of "there are".

The mention of AES-GCM is only optimal if using hardware and counters (see
the router link below), otherwise the random nonce is too small. I'm not
sure if this is a practical issue for implementations.

I would like if the implementation issues section had a section on
libraries not filtering out obsolete signature algorithms and cipher
suites, and not checking small key sizes (even on the root certificate):

http://googleonlinesecurity.blogspot.com/2013/11/a-roster-of-tls-cipher-suites-weaknesses.html
https://wiki.mozilla.org/CA:MD5and1024
http://csrc.nist.gov/groups/ST/hash/policy.html

Additionally, the URL to Georgiev2012 is to
http://doi.acm.org/10.1145/2382196.2382204 which is a paywalled site: it
would be more effective for readers if it pointed to the accessable URL
http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf

Will Sargent
Consultant, Professional Services
Typesafe <http://typesafe.com>, the company behind Play Framework
<http://www.playframework.com>, Akka <http://akka.io> and Scala
<http://www.scala-lang.org/>

On Tue, Aug 12, 2014 at 1:55 PM, Yaron Sheffer <[email-masked]>
wrote:

> To: Yaron Sheffer <[email-masked]>, Ralph Holz <[email-masked]>,
> Peter Saint-Andre <[email-masked]>, Ralph Holz <[email-masked]>,
> Peter Saint-Andre <[email-masked]>, Yaron Sheffer <[email-masked]>
>
>
> URL: http://www.ietf.org/internet-drafts/draft-ietf-uta-tls-attacks-02.txt
> Diff: http://www.ietf.org/rfcdiff?url2=draft-ietf-uta-tls-attacks-02
>
> Abstract:
> _______________________________________________
> Uta mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/uta
>

---

From: Watson Ladd <[email-masked]>
Date: Wed, 13 Aug 2014 11:27:35 -0700

On Aug 13, 2014 10:30 AM, "Will Sargent" <[email-masked]> wrote:
> The mention of AES-GCM is only optimal if using hardware and counters
(see the router link below), otherwise the random nonce is too small. I'm
not sure if this is a practical issue for implementations.

It is: don't use a random nonce with GCM, because it turns into an ntwice.
libraries not filtering out obsolete signature algorithms and cipher
suites, and not checking small key sizes (even on the root certificate):
> Typesafe, the company behind Play Framework, Akka and Scala
>
>
>> To: Yaron Sheffer <[email-masked]>, Ralph Holz <[email-masked]>,
Peter Saint-Andre <[email-masked]>, Ralph Holz <[email-masked]>, Peter
Saint-Andre <[email-masked]>, Yaron Sheffer <[email-masked]>
>> Status:
https://datatracker.ietf.org/doc/draft-ietf-uta-tls-attacks/

---

From: Will Sargent <[email-masked]>
Date: Wed, 13 Aug 2014 11:58:57 -0700

Also, I think if this is discussing current attacks on TLS, then it should
mention Flame as an in the wild attack on MD5:

https://www.trailofbits.com/resources/flame-md5.pdf

Will Sargent

On Wed, Aug 13, 2014 at 11:27 AM, Watson Ladd <[email-masked]> wrote:

> >> To: Yaron Sheffer <[email-masked]>, Ralph Holz <
> [email-masked]>, Peter Saint-Andre <[email-masked]>, Ralph Holz <
> [email-masked]>, Peter Saint-Andre <[email-masked]>, Yaron Sheffer <
> [email-masked]>
> >>
> >>
> >> Htmlized:
> http://tools.ietf.org/html/draft-ietf-uta-tls-attacks-02

---

From: Yaron Sheffer <[email-masked]>
Date: Thu, 14 Aug 2014 00:12:58 +0300

Hi Will,

I think FLAME should be out of scope, because it is an attack on PKI 
rather than SSL. Besides, MD5 has been beaten to death elsewhere.

Also, a recommendation on GCM nonce usage belongs to the BCP draft and 
not to this one.

Other than that, I am fine with your comments.

Thanks,
	Yaron

On 08/13/2014 09:58 PM, Will Sargent wrote:
> Also, I think if this is discussing current attacks on TLS, then it
> should mention Flame as an in the wild attack on MD5:
>
> On Wed, Aug 13, 2014 at 11:27 AM, Watson Ladd <[email-masked]
> <mailto:[email-masked]>> wrote:
>
>
>     On Aug 13, 2014 10:30 AM, "Will Sargent" <[email-masked]
>     <mailto:[email-masked]>> wrote:
>      >
>      > The mention of AES-GCM is only optimal if using hardware and
>     counters (see the router link below), otherwise the random nonce is
>     too small. I'm not sure if this is a practical issue for
>     implementations.
>
>      > I would like if the implementation issues section had a section
>     on libraries not filtering out obsolete signature algorithms and
>     cipher suites, and not checking small key sizes (even on the root
>     certificate):
>      >
>      >
>     http://doi.acm.org/10.1145/2382196.2382204 which is a paywalled
>     site: it would be more effective for readers if it pointed to the
>     accessable URL http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf
>      >
>      > Will Sargent
>      > On Tue, Aug 12, 2014 at 1:55 PM, Yaron Sheffer
>     <[email-masked] <mailto:[email-masked]>> wrote:
>      >>
>      >> Dear UTA folks,
>      >>
>      >> This version incorporates feedback from shortly before, during
>     and following the Toronto meeting. The changes are:
>      >>
>      >> From: [email-masked] <mailto:[email-masked]>
>      >> To: Yaron Sheffer <[email-masked]
>     <mailto:[email-masked]>>, Ralph Holz <[email-masked]
>     <mailto:[email-masked]>>, Peter Saint-Andre <[email-masked]
>     <mailto:[email-masked]>>, Ralph Holz <[email-masked]
>     <mailto:[email-masked]>>, Peter Saint-Andre <[email-masked]
>     <mailto:[email-masked]>>, Yaron Sheffer <[email-masked]
>     <mailto:[email-masked]>>
>      >>
>      >>
>      >> until the htmlized version and diff are available at
>     tools.ietf.org <http://tools.ietf.org>.
>      >>
>      >> The IETF Secretariat
>      >>
>      >>
>      >>
>      >> [email-masked] <mailto:[email-masked]>
>      > [email-masked] <mailto:[email-masked]>

---

From: Leif Johansson <[email-masked]>
Date: Thu, 14 Aug 2014 17:17:16 +0200

> Other than that, I am fine with your comments.

So do you believe, given these comments and the review you got, that the
draft is ready for WGLC?

If so maybe we could address the final additions during WGLC.

	Cheers Leif

---

From: Yaron Sheffer <[email-masked]>
Date: Thu, 14 Aug 2014 19:06:01 +0300

> If so maybe we could address the final additions during WGLC.

Hi Leif,

Yes, I believe the draft is mature enough to go to WGLC. Of course we 
will incorporate these comments, along with any LC comments into the 
next version of the draft.

Best,
	Yaron

---

From: Leif Johansson <[email-masked]>
Date: Thu, 14 Aug 2014 18:12:54 +0200

> next version of the draft.

Very well,

The chairs will start WGLC for the attack draft tomorrow unless there
are opposition from the WG.

	Cheers Leif

---

From: Aaron Zauner <[email-masked]>
Date: Mon, 18 Aug 2014 01:17:35 +0200

Hi *,

A bit of feedback on the attack draft:

2.1:
```
In the context of Web traffic, these attacks are only effective if the
client accesses a Web server using a mixture of HTTP and HTTPS.
```

I'm not entirely sure that this is correct. Maybe I'm just
misunderstanding this sentence, but in the original presentation Moxie
[0] describes an active MITM scenario, where any link could be rewritten
from https to http - even if the destination Webserver would only allow
for https. The MITM proxy may terminate HTTP and forward traffic as
HTTPS (i.e. present itself as an https client to the server). This is
why we have HSTS as far as I know. Am I missing something?

2.5:
```
2.5.  Compression Attacks: CRIME and BREACH
```

Would change to "CRIME, TIME and BREACH" as TIME is also mentioned in
this subsection.

2.9:
```
2.9.  Triple Hanshake
```

Typo in "Hanshake" -> "Handshake".

2.11: mentions missing server certificate validation in Python 2 without
a reference to this claim.

Also missing is any mention of the (very recent) BlackHat USA 2014 talk
and paper by Antoine Delignat-Lavaud [1] [2] on Vhost confusion attacks
by downgrading to SSLv3. Since this poses a real world security issue
I'm for adding a paragraph to this draft - which might also come in
handy for the BCP as SSLv3 is currently being discussed to be changed to
MUST NOT.

Thanks for your time,
Aaron

[0] -
https://www.blackhat.com/presentations/bh-dc-09/Marlinspike/BlackHat-DC-09-Marlinspike-Defeating-SSL.pdf
[1] - http://bh.ht.vc/bh_slides.pdf
[2] - http://bh.ht.vc/vhost_confusion.pdf

---

From: Aaron Zauner <[email-masked]>
Date: Mon, 18 Aug 2014 01:22:31 +0200

Aaron Zauner wrote:
> 2.11: 
There's also a second - recent - paper on certificate validation issues
in implementations that should be added as a reference:

https://www.cs.utexas.edu/~shmat/shmat_oak14.pdf
https://github.com/sumanj/frankencert

Aaron