Subject: [TLS] Questions about some expired drafts

From: "Salz, Rich" <[email-masked]>
Date: Tue, 27 Jan 2015 19:45:54 +0000

https://tools.ietf.org/html/draft-rescorla-tls-opaque-prf-input-00
https://tools.ietf.org/html/draft-rescorla-tls-extended-random-02
OpenSSL includes at least the opaque-prf one.  Any reason to keep the code?  (I'm ripping out all sorts of old stuff now)

--
Principal Security Engineer, Akamai Technologies
IM: [email-masked]<mailto:[email-masked]> Twitter: RichSalz

---

From: Aaron Zauner <[email-masked]>
Date: Tue, 27 Jan 2015 21:32:51 +0100

Hi *,

Salz, Rich wrote:
> OpenSSL includes at least the opaque-prf one.  Any reason to keep the
> code?  (I’m ripping out all sorts of old stuff now)
> 
I see no value in keeping either of both drafts implemented.

* draft-rescorla-tls-opaque-prf-input-00:
Section 4. pretty much states what any reader of the document will
conclude; implementing this document will probably cause more (fatal)
implementation errors rather than adding anything useful to TLS.
Furthermore it adds unnecessary complexity on both ends.

* draft-rescorla-tls-extended-random-02:
Same as above.

Also: BULLRUN/EDGEHILL explicitly mention subversion of standards by not
only the NSA but specifically one of the authors subdivisions. Don't
want to start tinfoil-hattery here but these IDs are rather useless, and
to be honest if US Gov. really /needs/ to use these extensions they
could go ahead and use them anyway without being a standard as they do
with other crypto primitives.

Aaron

---

From: Yuhong Bao <[email-masked]>
Date: Tue, 27 Jan 2015 17:22:19 -0800

Yea, I believe the draft-rescorla-tls-extended-random is quite famous as a backdoor, 
along with Dual_EC_DRBG.

----------------------------------------
Date: Tue, 27 Jan 2015 21:32:51 +0100
From: [email-masked]
To: [email-masked]
Subject: Re: [TLS] Questions about some expired drafts

Hi *,

Aaron

_______________________________________________
TLS mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/tls

---

From: Stephen Checkoway <[email-masked]>
Date: Fri, 30 Jan 2015 01:06:16 -0500

> Yea, I believe the draft-rescorla-tls-extended-random is quite famous as a backdoor, 

Well, it makes attacks easier by exposing more consecutive raw Dual EC output bits. For P-384 and P-521, it makes the attack doable at all (at least in theory, I didn't actually validate that against an implementation that supported extended random like RSA's BSAFE libraries).

-- 
Stephen Checkoway