4 ms·

Not GP, but a wannabe level 3 [1] cryptographer. Why does TLS make you twitch? Does that apply to TLS 1.3? [1]: https://loup-vaillant.fr/articles/rolling-your

Not GP, but a wannabe level 3 [1] cryptographer. Why does TLS make you twitch? Does that apply to TLS 1.3? [1]: https://loup-vaillant.fr/articles/rolling-your-own-crypto https://loup-vaillant.fr/articles/rolling-your-own-crypto

cperciva 4y ago
TLS 1.3 is definitely better than previous versions. Note however that it wasn't published until 2018; Tarsnap's transport layer has been in use since 2007, before even TLS 1.2 was published. If I had used TLS at the time, it would have been TLS 1.1. Hopefully you agree that would have been a bad thing?
- tptacek 4y ago
  I mean, TLS 1.1 isn't a good thing, but which <TLS1.3 bugs actually would have impacted Tarsnap? SMACK, maybe? Probably not POODLE, given the ciphersuites you'd have locked down to. Not BERserk (you'd never use NSS). The TLS BB'98 attacks didn't hit any library you'd actually use. No Triple Handshake, since you wouldn't do renegotiation. No BREACH, TIME or CRIME (they don't fit Tarsnap anyways). No RC4 (lol). No Lucky13, for the same reason as no POODLE. No BEAST, because you don't do Javascript. And now we're back to 2007 (or pre-2007) for attacks on TLS.
  - cperciva 4y ago
    It's possible that I could have taken TLS 1.1 and removed all the broken parts, sure. I mean, that's pretty much what TLS 1.3 is. But frankly I trust my ability -- both now and in 2007 -- to use standard cryptographic algorithms to build a new protocol far more than I trust my ability to remove all the crap from TLS 1.1. (Did you deliberately not mention heartbleed?)
    - tptacek 4y ago
      Heartbleed isn't a TLS vulnerability any more than an overflow in GnuTLS is. The threshold question is, "could this vulnerability be reasonably expected to recur in independent implementations of the protocol?" As for stripping back TLS 1.1 --- it wouldn't take much more than simply picking a single ciphersuite and requiring TLS 1.1. You wouldn't need to know, for instance, about export ciphers.
      - cperciva 4y ago
        That seems like the wrong question. My options were "write my own protocol" or "use openSSL" -- writing my own TLS stack was never on the table.
        tptacek 4y ago
        Right, I get that, but you could have done the two config things I just mentioned with OpenSSL. I get why you didn't use OpenSSL. The normal thing for someone like you to do in 2022 would be to use Noise.
        alipitch 4y ago
        What are real world implementations of the Noise Protocol? https://github.com/noiseprotocol/noise_spec/blob/v34/noise.md https://github.com/noiseprotocol/noise_spec/blob/v34/noise.m... Quick search shows WireGuard protocol, but I am not sure if how much of the WireGuard protocol is the same as the Noise Protocol. https://www.wireguard.com/formal-verification/ https://www.wireguard.com/formal-verification/ https://www.wireguard.com/papers/wireguard-formal-verification.pdf https://www.wireguard.com/papers/wireguard-formal-verificati... The WireGuard protocol is extensively detailed in [2], which itself is based on the NoiseIK [3] handshake.
        alipitch 4y ago
        I found a page by Duo Labs listing Noise in Production. https://duo.com/labs/tech-notes/noise-protocol-framework-intro https://duo.com/labs/tech-notes/noise-protocol-framework-int... Noise is used today in several high-profile projects: WhatsApp uses the "Noise Pipes" construction from the specification to perform encryption of client-server communications WireGuard, a modern VPN, uses the Noise IK pattern to establish encrypted channels between clients Slack's Nebula project, an overlay networking tool, uses Noise The Lightning Network uses Noise I2P uses Noise
- ghoward 4y ago
  Yes, of course. I was just confused because it seemed like you were saying that even the new version of TLS was bad.

cperciva 4y ago

TLS 1.3 is definitely better than previous versions. Note however that it wasn't published until 2018; Tarsnap's transport layer has been in use since 2007, before even TLS 1.2 was published. If I had used TLS at the time, it would have been TLS 1.1. Hopefully you agree that would have been a bad thing?

tptacek 4y ago
I mean, TLS 1.1 isn't a good thing, but which <TLS1.3 bugs actually would have impacted Tarsnap? SMACK, maybe? Probably not POODLE, given the ciphersuites you'd have locked down to. Not BERserk (you'd never use NSS). The TLS BB'98 attacks didn't hit any library you'd actually use. No Triple Handshake, since you wouldn't do renegotiation. No BREACH, TIME or CRIME (they don't fit Tarsnap anyways). No RC4 (lol). No Lucky13, for the same reason as no POODLE. No BEAST, because you don't do Javascript. And now we're back to 2007 (or pre-2007) for attacks on TLS.
- cperciva 4y ago
  It's possible that I could have taken TLS 1.1 and removed all the broken parts, sure. I mean, that's pretty much what TLS 1.3 is. But frankly I trust my ability -- both now and in 2007 -- to use standard cryptographic algorithms to build a new protocol far more than I trust my ability to remove all the crap from TLS 1.1. (Did you deliberately not mention heartbleed?)
  - tptacek 4y ago
    Heartbleed isn't a TLS vulnerability any more than an overflow in GnuTLS is. The threshold question is, "could this vulnerability be reasonably expected to recur in independent implementations of the protocol?" As for stripping back TLS 1.1 --- it wouldn't take much more than simply picking a single ciphersuite and requiring TLS 1.1. You wouldn't need to know, for instance, about export ciphers.
    - cperciva 4y ago
      That seems like the wrong question. My options were "write my own protocol" or "use openSSL" -- writing my own TLS stack was never on the table.
      - tptacek 4y ago
        Right, I get that, but you could have done the two config things I just mentioned with OpenSSL. I get why you didn't use OpenSSL. The normal thing for someone like you to do in 2022 would be to use Noise.
        alipitch 4y ago
        What are real world implementations of the Noise Protocol? https://github.com/noiseprotocol/noise_spec/blob/v34/noise.md https://github.com/noiseprotocol/noise_spec/blob/v34/noise.m... Quick search shows WireGuard protocol, but I am not sure if how much of the WireGuard protocol is the same as the Noise Protocol. https://www.wireguard.com/formal-verification/ https://www.wireguard.com/formal-verification/ https://www.wireguard.com/papers/wireguard-formal-verification.pdf https://www.wireguard.com/papers/wireguard-formal-verificati... The WireGuard protocol is extensively detailed in [2], which itself is based on the NoiseIK [3] handshake.
        alipitch 4y ago
        I found a page by Duo Labs listing Noise in Production. https://duo.com/labs/tech-notes/noise-protocol-framework-intro https://duo.com/labs/tech-notes/noise-protocol-framework-int... Noise is used today in several high-profile projects: WhatsApp uses the "Noise Pipes" construction from the specification to perform encryption of client-server communications WireGuard, a modern VPN, uses the Noise IK pattern to establish encrypted channels between clients Slack's Nebula project, an overlay networking tool, uses Noise The Lightning Network uses Noise I2P uses Noise
ghoward 4y ago
Yes, of course. I was just confused because it seemed like you were saying that even the new version of TLS was bad.