Subject: [Cfrg] Cross-protocol primitive diversity

From: Dan Brown <[email-masked]>
Date: Wed, 14 Oct 2015 19:24:04 +0000

Dear CFRG,

Does cross-protocol diversity of primitives improve Internet security? 

If non-interoperating protocols (e.g. TLS and IPSec) use _unrelated_
primitives, then one crypto primitive failing will not harm _all_ protocols.

Note, I'm not saying a single protocol should have many optional primitives
(enabling an adversary to target the weakest option.)  Rather, I am saying
that since a user is usually already using multiple layers of crypto
protocols (e.g., corresponding to different network layers such as S/MIME,
TLS, IPSec, WiFi) all to protect one message, it would be disappointing if a
single primitive that all the protocols relied upon, such as AES, had some
weakness, such as a side channel, thereby compromising the message, despite
the multiple layers.  If one of those layers had an alternative primitive,
say ChaCha, then they would still offer some residual protection.  Of
course, each protocol protects against specific sets of adversary, so the
residual protection might only be against a small set of adversaries.
Nonetheless, the user might be better off.  

For comparison, optionality means, for example, AES or ChaCha, whereas the
diversity I'm seeking is AES and ChaCha, at least whenever multiple crypto
primitives are already going to be applied.

Obviously, a single zero-risk primitive works too, the only gain from this
diversity approach is for primitives with non-zero risk.  So my question
here can rephrased: is the risk of the current best few primitives in a
class (e.g. hashes or AEAD schemes), high enough to warrant the diversity
approach above (or is the approach even effective?).

Of course, with such a diversified portfolio of primitives, it is still
important, and even more difficult, to study and implement the primitives,
so CFRG could recommend only a _few_ of each kind of primitive, e.g.
SHA-512, SHA-3-512 and Blake2-512 as good hashes.  

Best regards,

Daniel Brown

Research In Motion Limited

---

From: Ilari Liusvaara <[email-masked]>
Date: Wed, 14 Oct 2015 23:06:38 +0300

> Does cross-protocol diversity of primitives improve Internet security? 

Well, from game theory, there is a result that if one has multiple
strategies with same known risks but different unknown risks, the
optimal way is to pick strategies randomly for each round.

However, applying this is difficult at best.
 
> primitives, then one crypto primitive failing will not harm _all_

And considering usage of various crypto protocols, the usage wouldn't be
even nearly even, nor would it really help in case one broke.

Furthermore, not all breakages are equal. Some breakages only matter
in active attack. Some others also matter for passive attack. Other
breakages may be much nastier to recover from than others.

Hash function breakage is actually pretty nasty to recover from, since
in practice "algorithm agility" mechanisms rely that hash functions
work properly. E.g. SHA-256 being broken would cause a major Charile
Foxtrot with TLS (and various other protocols)[1].

[1] Well, the "solution" would be obvious: Implement (or enable if
already implemented) new ciphersuites with new prf-hashes and
deimplement old ones. Except this does not work in practice.[2]

[2] RC4 in TLS is still out there. And 5.5 year old security
fixes to TLS still aren't reliably deployed.

-Ilari