Subject: [TLS] draft-ietf-tls-rfc8446bis - Security propterites - Protection of endpoint identities

From: John Mattsson <[email-masked]>
Date: Wed, 10 Feb 2021 09:19:15 +0000

Hi,

TLS 1.3 has several stated security properties. One of them is "Protection of endpoint identities". EAP-TLS 1.3 (up until version -13) was written with the assumption that this property holds. Other uses of TLS 1.3 might also rely on the property to hold. With draft-camwinget-tls-ts13-macciphersuites, the "Protection of endpoint identities" does no longer hold in general. I think RFC8446bis needs to state that this property only holds for cipher suites with confidentiality.

Cheers,
John

---

From: Ben Smyth <[email-masked]>
Date: Wed, 10 Feb 2021 12:09:11 +0100

On Wed, 10 Feb 2021, 10:19 John Mattsson, <john.mattsson=
[email-masked]> wrote:

> I think RFC8446bis needs to state that this property only holds for cipher
> suites with confidentiality.
>

All cipher suites defined by RFC8446bis (Appendix B.4) provide
confidentiality. The property always holds.

---

From: Ben Smyth <[email-masked]>
Date: Wed, 10 Feb 2021 15:00:13 +0100

On Wed, 10 Feb 2021 at 12:09, Ben Smyth <[email-masked]> wrote:

>> I think RFC8446bis needs to state that this property only holds for
>> cipher suites with confidentiality.
>>
>

Given that Appendix C.5 discusses unauthenticated cipher suites, perhaps
Appendix B.4 could be extended as follows:

Previous versions of TLS explicitly offered a null cipher (wherein
encryption consists of the identity operation, i.e., the data is not
encrypted). These modes have been deprecated in TLS 1.3.

(At least, that's my understanding.)

---

From: "Salz, Rich" <[email-masked]>
Date: Wed, 10 Feb 2021 16:10:41 +0000

*   Previous versions of TLS explicitly offered a null cipher (wherein encryption consists of the identity operation, i.e., the data is not encrypted). These modes have been deprecated in TLS 1.3.

These modes have been *removed* in TLS 1.3  Further, the only ciphers in the RFC provide authenticated encryption. I think anything that doesn’t provide that is going to get an “N” in the recommended column FWIW.  I’m one of three experts for that registry.
                /r$

---

From: Eric Rescorla <[email-masked]>
Date: Wed, 10 Feb 2021 09:17:28 -0800

Agreed. With that said, I don't think it would hurt to add some text. John,
would you like to provide a PR?

-Ekr

On Wed, Feb 10, 2021 at 8:11 AM Salz, Rich <rsalz=
[email-masked]> wrote:

>
>    - Previous versions of TLS explicitly offered a null cipher (wherein
> These modes have been **removed** in TLS 1.3  Further, the only ciphers
> in the RFC provide authenticated encryption. I think anything that doesn’t
> provide that is going to get an “N” in the recommended column FWIW.  I’m
> one of three experts for that registry.
>
>                 /r$
>
>
>
>
>
>
>
>
>
>
> _______________________________________________
> TLS mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/tls
>

---

From: John Mattsson <[email-masked]>
Date: Thu, 11 Feb 2021 09:07:44 +0000

Sure

https://github.com/tlswg/tls13-spec/pull/1210

John

From: Eric Rescorla <[email-masked]>
Date: Wednesday, 10 February 2021 at 18:18
To: "Salz, Rich" <[email-masked]>
Cc: "[email-masked]" <[email-masked]>, John Mattsson <[email-masked]>, "[email-masked]" <[email-masked]>
Subject: Re: [TLS] draft-ietf-tls-rfc8446bis - Security propterites - Protection of endpoint identities

Agreed. With that said, I don't think it would hurt to add some text. John, would you like to provide a PR?

-Ekr

On Wed, Feb 10, 2021 at 8:11 AM Salz, Rich <rsalz=[email-masked]<mailto:[email-masked]>> wrote:

· Previous versions of TLS explicitly offered a null cipher (wherein encryption consists of the identity operation, i.e., the data is not encrypted). These modes have been deprecated in TLS 1.3.

_______________________________________________
TLS mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/tls