Re: Secdir last call review of draft-ietf-tls-exported-authenticator-09

[Yaron Sheffer <yaronf.ietf@xxxxxxxxx>]

Hi Nick,

 

Apologies for not responding on time.

 

I may be missing some follow-on discussions, but:

 

• Ben suggested that we mention that QUIC is also an option, even if informatively, in addition to the “SHOULD use TLS” statement.
• I think we left my question re: back-fitting this protocol into the IANA TLS registry open. Quoting:

 

YS: 7.1: this is changing TLS 1.3 by allowing this extension in Cert Request! I think it's a really bad idea. Better to hack special support to existing libraries, allowing this specific extension for this special case, than to change the base protocol. Otherwise, this document should UPDATE 8446.

 

NS: This is a good point and one that we struggled a bit with during design. We needed to allow SNI in the CertificateRequest message because it can be client-generated in this context. I'd be ok with creating a different extension for this, but it's rather elegant to re-use it in this context. *I'd like to hear some opinions from the working group* on this point

 

BK: Or, since extension codepoints are cheap, just use a new codepoint.

 

Thanks,

                Yaron

 

From: Nick Sullivan <nick@xxxxxxxxxxxxxx>
Date: Monday, November 4, 2019 at 04:49
To: Yaron Sheffer <yaronf.ietf@xxxxxxxxx>
Cc: <secdir@xxxxxxxx>, <draft-ietf-tls-exported-authenticator.all@xxxxxxxx>, <ietf@xxxxxxxx>, "<tls@xxxxxxxx>" <tls@xxxxxxxx>
Subject: Re: Secdir last call review of draft-ietf-tls-exported-authenticator-09

 

Following up,

 

Yaron, do the responses by myself and Benjamin along with the does the following PR sufficiently address your comments/concerns?

 

https://github.com/tlswg/tls-exported-authenticator/pull/52

 

On Wed, Sep 18, 2019 at 4:55 PM Nick Sullivan <nick@xxxxxxxxxxxxxx> wrote:

Hi Yaron,

 

Thank you for your thorough review. My answers will be inline, and I'll incorporate some of Ben's replies if necessary. Here's a PR with proposed changes in response to your comments:

https://github.com/tlswg/tls-exported-authenticator/pull/52

 

On Tue, Jul 16, 2019 at 12:59 PM Yaron Sheffer via Datatracker <noreply@xxxxxxxx> wrote:

Reviewer: Yaron Sheffer
Review result: Has Issues

The document is generally clear in both its motivation and the proposed
solution.

I think it's playing a bit too liberal with TLS 1.3, in sort-of but not quite
deprecating renegotiation, and in changing the IANA registry in a way that
actually changes the protocol. Details below.

Other comments:

* Abstract: please reword to make it clear that it's the proof (not the cert)
that is portable.

 

Proposed text here:

This document describes a mechanism in Transport Layer Security (TLS) for peers to
provide a proof of ownership of a certificate.  This proof can be exported
by one peer, transmitted out-of-band to the other peer, and verified by the receiving peer.

 

* Introduction: TLS 1.3 post-handshake auth "has the
disadvantage of requiring additional state to be stored as part of the TLS
state machine." Why is that an issue is practice, assuming this feature is
already supported by TLS libraries? Also, are we in effect deprecating this TLS
1.3 feature because of the security issue of the mismatched record boundaries?

 

My understanding is that post-handshake authentication as defined in the TLS 1.3 RFC is not implemented in many (any?) TLS 1.3 libraries and some implementors would prefer to use exported authenticators.

 

* "For simplicity, the mechanisms... require", maybe a normative REQUIRE?

I'm fine with this.

 

* Authenticator Request: please clarify that we use the TLS 1.3 format even when
running on TLS 1.2..

 Updated, though it might be a bit unnecessary.

 

* Also, I suggest to change "is not encrypted with a
handshake key" which is too specific to "is sent unencrypted within the normal
TLS-protected data".

This specific text is meant to differentiate the wire format of this message from that of the CertificateRequest message, which is encrypted with the handshake key. The specificity is warranted.

 

* Before diving into the detailed messages in Sec. 3, it
would be nice to include a quick overview of the message sequence.

There are two message types and three potential sequences. I've added a short overview.

 

* Sec. 3:
"SHOULD use TLS", change to MUST. There's no way it can work otherwise anyway.

As Ben noted, this could be any secure channel with equivalent security to TLS, such as QUIC. We shouldn't forbid other secure out-of-band mechanisms.

 

* "This message reuses the structure to the CertificateRequest message" -
repeats the preceding paragraph.

Fixed

 

* Sec. 4: again, SHOULD use TLS -> MUST.

Again, I don't see the need for a MUST here.

 

* Is
there a requirement for all protocol messages to be sent over a single TLS
connection? If so, please mention it. Certainly this is true for the
Authenticator message that must be sent over a single connection and cannot be
multiplexed by the high-level protocol. I think this protocol actually assumes
"nice" transport properties (no message reorder, reliability) that also require
a single, clean TLS connection.

There is no such requirement. Message ordering is managed by the application layer protocol that utilizes exported authenticators.

 

* Why no authenticator request for servers?
Don't we care about replay? OTOH if the client wants to detect replays, it
would need to keep state on received authenticators, which would be very messy.

I'm not sure I understand. It's possible to use authenticator requests for servers.

 

* 4.1: when referencing Exporters, mention this is Sec. 7.5 of [TLS1.3].

Added  "Sec. 7.5"

 

* The
discussion of Extended Master Secret only applies to TLS 1.2 - please clarify
that, plus I suggest to reword this paragraph which I find hard to parse.

re-worded

 

*
4.2: "the extensions are chosen from the TLS handshake." - What does it mean
exactly, and how does an application even know which extensions were used at
the TLS layer? Reading further, we mention "ClientHello extensions." Maybe the
authenticator should also include a ClientHello message to indicate supported
extensions. Assuming we can peek into ClientHello contradicts the hopeful "even
if it is possible to implement it at the application layer" in Sec. 6.

 

This could be clearer. Effectively, the Certificate message in the Authenticator needs

to be constructed in a similar manner to how a Certificate message would be created

in a TLS handshake. Namely, it can only contain extensions that were present in either

the client hello or a preceding CertificateRequest.

 

You're right that this makes an assumption that the party creating the Authenticator

has access to the TLS handshake state. This implies that even if the Authenticator

is created in the application space, an additional API needs to be exposed to share

that information.

 

* 4.2.1:
the first sentence of the section is incomplete.

 

Fixed

 

* Can I use TLS 1.3-specific
extensions (oid_filters) if I'm running on a TLS 1.2 connection? Is there a
situation where a certificate is acceptable for TLS 1.3 connections but not for
TLS 1.2 connections?

Yes TLS 1.3-specific extensions are allowed, the CertificateRequest message is TLS 1.3-compatible.

 

* "using a value derived from the connection secrets" - I
think we should recommend a specific construction here to ensure people do it
securely.

This was a suggestion from the Additional Certificates use case (https://tools.ietf.org/html/draft-bishop-httpbis-http2-additional-certs-05). I'm not sure we should get into the details here.

 

* 4.2.3: Are we computing HMAC(MAC-key, Hash(a || b || c || d))? If
so, please say so.

Yes, I'll put that in.

 

* 4.2.4: "a constant-time comparison" - why is it actually
required, what is the threat? An attacker can do very little because each
authenticator being sent is different.

As Ben noted, this was a safety note added during review.

 

* 5: please say explicitly which
messages are used in this case to construct the authenticator.

 

Re-written. 

* 6.1: the
"MUST" is strange in a section that's only supposed to be informative. Also,
the library may provide this extension (and possibly others) without requiring
it as input.

How else do you propose wording the requirement that this API fail if the connection doesn't support EAs?

 

* 6.4: "The API MUST return a failure if the
certificate_request_context of the authenticator was used in a previously
validated authenticator." Are we requiring the library to keep previous
contexts for replay protection? If so, please make it explicit.

I think this can be a SHOULD based on the burden replay protection places on the implementation. 

 

*  7.1: this is
changing TLS 1.3 by allowing this extension in Cert Request! I think it's a
really bad idea. Better to hack special support to existing libraries, allowing
this specific extension for this special case, than to change the base
protocol. Otherwise, this document should UPDATE 8446.

 

This is a good point and one that we struggled a bit with during design. We needed to allow SNI in the CertificateRequest message because it can be client-generated in this context. I'd be ok with creating a different extension for this, but it's rather elegant to re-use it in this context. I'd like to hear some opinions from the working group on this point

 

* 8: I think the
Security Considerations is the right place to talk about interaction between
this protocol and TLS 1.3 (or 1.2) renegotiation. Even if we simply RECOMMEND
not to do it. Or else explain the use cases where renegotiation is still useful
if there are any.

 

I'm not sure this document should be prescriptive about use cases. This doc is providing a new capability that may be leveraged at the application to replace the functionality of existing mechanisms, but I'm not convinced the evaluation of the trade-offs of different mechanisms should be contained in this document.