Subject: [TLS] I-D Action: draft-ietf-tls-session-hash-01.txt

From: [email-masked]
Date: Fri, 22 Aug 2014 06:47:12 -0700

A New Internet-Draft is available from the on-line Internet-Drafts directories.
 This draft is a work item of the Transport Layer Security Working Group of the IETF.

        Title           : Transport Layer Security (TLS) Session Hash and Extended Master Secret Extension
        Authors         : Karthikeyan Bhargavan
                          Antoine Delignat-Lavaud
                          Alfredo Pironti
                          Adam Langley
                          Marsh Ray
	Filename        : draft-ietf-tls-session-hash-01.txt
	Pages           : 8
	Date            : 2014-08-22

Abstract:
   The Transport Layer Security (TLS) master secret is not
   cryptographically bound to important session parameters such as the
   client and server identities.  Consequently, it is possible for an
   active attacker to set up two sessions, one with a client and another
   with a server, such that the master secrets on the two sessions are
   the same.  Thereafter, any mechanism that relies on the master secret
   for authentication, including session resumption, becomes vulnerable
   to a man-in-the-middle attack, where the attacker can simply forward
   messages back and forth between the client and server.  This
   specification defines a TLS extension that contextually binds the
   master secret to a log of the full handshake that computes it, thus
   preventing such attacks.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-tls-session-hash/

There's also a htmlized version available at:
http://tools.ietf.org/html/draft-ietf-tls-session-hash-01

A diff from the previous version is available at:
http://www.ietf.org/rfcdiff?url2=draft-ietf-tls-session-hash-01

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: Peter Dettman <[email-masked]>
Date: Tue, 26 Aug 2014 16:28:07 +0700

Thanks to the authors for their time and effort in preparing this draft. 
I spent some time today implementing it in the BouncyCastle TLS 
client/server, and have a few comments:

1. Initially I was focused on replacing the "seed" input to the PRF, and 
overlooked that the label ("extended master secret") had also changed. 
It might be worth adverting to that in the surrounding text.

2. Section 5.2 appears to make acceptance of the extension compulsory 
i.e. that the server MUST negotiate the extension. Is there a clause 
missing there (e.g. "... if it wishes to negotiate use of the extended 
master_secret derivation"), or is it really intended that the handshake 
must fail when the server doesn't implement this feature?

3. Also in 5.2, I have issues with the "Implementation note" regarding 
resumption. Existing RFCs say that a server choosing resumption should 
ignore client extensions and (MUST) not send any server extensions (RFC 
5746 is already an exception to this, but do we want to add more 
exceptions?). Some server implementations do send them regardless, so in 
our client we just ignore those in favour of the resumed-session 
extensions. The rule described in this implementation note does not make 
the logic simpler; I would like to see this bit removed and just refer 
to the existing rules for resumption - don't send the extension.

If anyone puts up a test server implementing this draft, please let me know.

Pete Dettman

On 22/08/2014 8:47 pm, [email-masked] wrote:
> _______________________________________________
> TLS mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/tls