Subject: [TLS] Question about client impersonation... was Re: ETSI releases standards for enterprise security and data centre management]

From: Dan Brown <[email-masked]>
Date: Sun, 2 Dec 2018 21:47:46 +0000

Is the security property  mentioned below a defined goal of, and proved‎ for, TLS 1.3?

Just curious, because it seems a little counter-intuitive: ‎impersonation of an anonymous (unauthenticated) client, under the harsh conditions of all content in the clear. It is certainly plausible by regarding the client as having a a MAC key and a pseudonym from the handshake: I think many key exchange proofs have a notion of sessions, etc., and PKE definitions also have notions of non-malleability, so I would not be surprised if a proof of this property is known for TLS 1.3. ‎ If there is a proof, then could it be said that eTLS defeats the proof, etc.

From: Tony Arcieri
Sent: Saturday, December 1, 2018 11:00 AM
To: [email-masked]
Cc: Crypto; <[email-masked]>
Subject: Re: [TLS] ETSI releases standards for enterprise security and data centre management

This does not seem to address a problem which was brought up when the similar draft-green-tls-static-dh-in-tls13-00 was discussed, namely any system in possession of one of the non-ephemeral-ECDHE private keys, ostensibly for the purposes of passive traffic decryption, can arbitrarily resume decrypted sessions and therefore impersonate any observed clients..

I'm not a fan of systems like this, but I believe for security reasons they should be designed in such a way that only the confidentiality of traffic is impacted, and a "visibility" system isn't able to leverage the decrypted traffic to resume decrypted sessions and thereby impersonate clients.

-- 
Tony Arcieri