Subject: Re: [TLS] Next steps for draft-agl-tls-padding

From: Peter Gutmann <[email-masked]>
Date: Sun, 6 Apr 2014 08:15:07 +0000

Peter Bowen <[email-masked]> writes:

>Other than updating the draft replace "TBD" with "21" are there other open
>issues?

Not that I know of, the only other change has been to include some comments
(suggested by ekr) about active attacks in the Security Considerations
section.

Peter.

---

From: Watson Ladd <[email-masked]>
Date: Sun, 6 Apr 2014 10:51:05 -0700

> (suggested by ekr) about active attacks in the Security Considerations

You mean the text on covert channels? I always thought the way to
avoid covert channels was to use implementations that didn't have
them. In particularly, ECDSA has a covert channel which cannot be
closed, and so does OAEP signature.

It's not wrong, just incredibly weird that this would be considered
worth adding to the draft.

Sincerely,
Watson Ladd

>
> Peter.
> _______________________________________________
> TLS mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/tls

-- 
"Those who would give up Essential Liberty to purchase a little
Temporary Safety deserve neither  Liberty nor Safety."
-- Benjamin Franklin

---

From: Ilari Liusvaara <[email-masked]>
Date: Mon, 7 Apr 2014 00:17:51 +0300

> closed, and so does OAEP signature.

You mean can't be verifiably closed? Or something else?

AFAIK, there is no ECC-based signature primitive that is
publically deterministic (Ed25519 is no exception to this
rule).

Of course, ECDSA is rather bad ECC signature scheme as signature
schemes go...

-Ilari

---

From: Watson Ladd <[email-masked]>
Date: Sun, 6 Apr 2014 14:27:38 -0700

> You mean can't be verifiably closed? Or something else?

All covert channels can be closed by auditing the software. But if I
introduce a leak in the nonce bits of ECDSA that is subtle, or encode
data I want to exfiltrate in the random padding of OAEP, even with the
private key, I cannot detect this.

> Of course, ECDSA is rather bad ECC signature scheme as signature

Sincerely,
Watson ladd

---

From: Ilari Liusvaara <[email-masked]>
Date: Mon, 7 Apr 2014 00:31:14 +0300

> private key, I cannot detect this.

Ah, the model is post-hoc auditing with access to private key. Got it.

And yeah, there are EC signature primitives that are deterministic and
auditable in that model (such as Ed25519)...

-Ilari

---

From: Manuel Pégourié-Gonnard <[email-masked]>
Date: Mon, 07 Apr 2014 19:22:47 +0200

> auditable in that model (such as Ed25519)...
It seems to me that deterministic usage of ECDSA as documented in RFC 6979 is
also auditable in that model. Am I missing something?

Manuel.