5 ms·

It looks like Noise leaves an implementer with more than enough rope to hang themselves with - for example, it allows unauthenticated Diffie-Hellman, it appears

by makomk 11y ago

It looks like Noise leaves an implementer with more than enough rope to hang themselves with - for example, it allows unauthenticated Diffie-Hellman, it appears to permit user-selected handshake sequences, has 16(!) different official handshake sequences with subtly different properties, each of which allow payloads to be attached to any message in the handshake process that in turn have different levels of reduced security, etc.

tptacek 11y ago
You're describing Noise. WhatsApp uses Noise Pipes, which is one of many instances of the Noise framework. You're right that it's not a good idea for generalists to pick up Noise and go to town with it. Noise isn't misuse-proof.
- lmm 11y ago
  > You're right that it's not a good idea for generalists to pick up Noise and go to town with it. Noise isn't misuse-proof. Nor is SSL. Couldn't an opinionated SSL library (supporting exactly one protocol version, one cipher only, etc) provide the same simplicity of use while remaining interoperable and reusing an already-validated protocol?
  - tptacek 11y ago
    Simplicity of use isn't the only benefit they get from Noise Pipes; they also get increased security, in a couple of important ways. It's not the choice I would have made, but I am not as good as Moxie or Trevor.
  - rakoo 11y ago
    FYI there is an RFC (currently a draft) for a suite of parameters considered secure for some time, ie some kind of LTS: https://tools.ietf.org/html/draft-gutmann-tls-lts-02 https://tools.ietf.org/html/draft-gutmann-tls-lts-02 The idea is more or less what you want, hardcode some known-good configuration for servers that can't or won't be upgraded every other month.
    - tptacek 11y ago
      This is less a practical draft and more a political statement about the author's dislike for TLS 1.3. In particular, it makes extensive modifications to the TLS protocol itself (it doesn't merely propose a limited set of safe parameters).
    - wolf550e 11y ago
      That appears to not fully interoperate with regular TLS implementations, and does not require the use of the most popular secure ciphersuite ECDHE_RSA_AESGCM. If they need to make changes to make it secure, define an extension and say this profile makes the extension mandatory (like MAC-then-encrypt), but don't just change the protocol.

by makomk 11y ago

tptacek 11y ago

You're describing Noise. WhatsApp uses Noise Pipes, which is one of many instances of the Noise framework. You're right that it's not a good idea for generalists to pick up Noise and go to town with it. Noise isn't misuse-proof.

lmm 11y ago
> You're right that it's not a good idea for generalists to pick up Noise and go to town with it. Noise isn't misuse-proof. Nor is SSL. Couldn't an opinionated SSL library (supporting exactly one protocol version, one cipher only, etc) provide the same simplicity of use while remaining interoperable and reusing an already-validated protocol?
- tptacek 11y ago
  Simplicity of use isn't the only benefit they get from Noise Pipes; they also get increased security, in a couple of important ways. It's not the choice I would have made, but I am not as good as Moxie or Trevor.
- rakoo 11y ago
  FYI there is an RFC (currently a draft) for a suite of parameters considered secure for some time, ie some kind of LTS: https://tools.ietf.org/html/draft-gutmann-tls-lts-02 https://tools.ietf.org/html/draft-gutmann-tls-lts-02 The idea is more or less what you want, hardcode some known-good configuration for servers that can't or won't be upgraded every other month.
  - tptacek 11y ago
    This is less a practical draft and more a political statement about the author's dislike for TLS 1.3. In particular, it makes extensive modifications to the TLS protocol itself (it doesn't merely propose a limited set of safe parameters).
  - wolf550e 11y ago
    That appears to not fully interoperate with regular TLS implementations, and does not require the use of the most popular secure ciphersuite ECDHE_RSA_AESGCM. If they need to make changes to make it secure, define an extension and say this profile makes the extension mandatory (like MAC-then-encrypt), but don't just change the protocol.