Subject: Re: [TLS] Deprecating more (DSA?)

From: Peter Gutmann <[email-masked]>
Date: Fri, 18 Apr 2014 03:12:18 +0000

Watson Ladd <[email-masked]> writes:

>I would like to note in particular that 3DES has a 64-bit block, which limits
>the transferable data to 2^32 blocks, and so as a backup to AES it is
>painful. 

You missed the "theoretically" in there.  I realise you can come up with all
manner of obscure corner cases where it's an issue, but in practice which
typical users of TLS (browsers, IM, etc) are going to be affected?  In fact
even for some pathological case where users actually will be moving more than
4GB over TLS, what real, practical impact is there?

(Note: I know what the theoretical issue is, I'm asking what the real-world
impact will actually be).

Peter.

---

From: Watson Ladd <[email-masked]>
Date: Thu, 17 Apr 2014 20:28:29 -0700

> 4GB over TLS, what real, practical impact is there?

We can always rekey frequently to solve this, so it is mitigatable.
The lack of AEAD with it is also fixable.

The issue is that we leak the xor of two plaintext blocks in event of
collision of outputs in CBC mode. In CTR mode I would need to do a lot
more analysis to come up with the exact impact: you may have quite a
few more blocks to play with.

I don't feel comfortable ever endorsing a mechanism in TLS that is not
theoretically sound.

Sincerely,
Watson Ladd
> _______________________________________________
> TLS mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/tls

-- 
"Those who would give up Essential Liberty to purchase a little
Temporary Safety deserve neither  Liberty nor Safety."
-- Benjamin Franklin