3 ms·

PQE is probably a good catalyst for change here. It could easily have become a ‘forever protocol’ like IPv4, but there’s a point where maintaining two competing

by greggsy 2mo ago

PQE is probably a good catalyst for change here. It could easily have become a ‘forever protocol’ like IPv4, but there’s a point where maintaining two competing standards becomes onerous, especially when the newer one has wider support, fewer ‘bad’ configuration options to get wrong (can’t say the same for IPv6 unfortunately). Quantum resistance has also become a requirement in many regulatory environments, so this is a good opportunity to force that transition towards TLSv1.3. They have been nudging for some time, but 1.2 is still somehow the default in a lot of products.

tialaramex 2mo ago
TLS 1.2 is known to have a lot of problems that wouldn't in practice be fixed by extensions except in the sense that TLS 1.3, for compatibility reasons, pretends to be a single "extension" to TLS 1.2 which I've characterized as "Fly-casual-this-is-TLS-1.3" and is not in reality an extension at all. Among the worst problems is that both cheap "We'll talk again soon" key agreement avoidance optimisations in TLS 1.2 are effectively security holes by design. However generally the problem in SSL and TLS up to 1.2 was that they're designed by software engineers who know some cryptography and then some real cryptographers are brought in at the end to check it works. Like having the civil engineer give your bridge design a once over after some non-engineers have made the plans it's just too late to do a proper job. "This bridge will definitely collapse and kill everyone" is avoidable, but "I dunno, this seems like a bad idea, I wouldn't do it that way" just gets ignored as too late. TLS 1.3 is the first version where cryptographers had actually proved it works before the protocol was set in stone. Now, the proof has a small misunderstanding (called the "Selfie" attack, it's not relevant to a web browser but people doing low-level peer-to-peer type stuff need to understand it before using TLS at all) but having it at all was a huge difference.
- DarkUranium 2mo ago
  TIL that TLS (before 1.3) was designed by non-cryptographers. What the hell.
  - ivanr 2mo ago
    You could argue that it was designed by one guy (Kipp Hickman) in three months: https://www.feistyduck.com/newsletter/issue_131_the_legend_of_kipp_hickman https://www.feistyduck.com/newsletter/issue_131_the_legend_o...
  - tialaramex 2mo ago
    I shouldn't undersell it quite as much as I did, the original SSL concept comes from Taher Elgamal who was ex-RSA and had published the cryptosystem named after him. So it's not really true that there aren't any cryptographers in the room. However more importantly what TLS (and earlier SSL) wants to do is extremely hard and once Javascript comes into the picture it's ludicrously harder for this to deliver security than basically any system ordinary people have used. Several "But obviously I would never do that" scenarios you'd learn about in a cryptography class like "What if your adversary can control part of the messages to be encrypted?" or "What if your adversary can force you to transmit the same exact message thousands or millions of times?" are routine requirements of security for HTTPS because of how the Web works. And for SSL in particular why would math people (which is what cryptographers are) even be interested? 30+ Years Ago Tim's hypermedia system is just a toy and while its name, "World Wide Web" does sound like a big deal it's not actually important to your everyday life. If you live in a big city and it has a "web page" on Tim's system it's probably knocked together by some IT nerd who works for the city and the actual local government have no idea what a "web page" even is. Probably by the time TLS 1.2 shipped, the relevant IETF Working Group (also named TLS) could have reached out and asked cryptography researchers to help first and got some engagement because it's obvious this is a big deal, but that didn't happen until TLS 1.3

by greggsy 2mo ago

tialaramex 2mo ago

TLS 1.2 is known to have a lot of problems that wouldn't in practice be fixed by extensions except in the sense that TLS 1.3, for compatibility reasons, pretends to be a single "extension" to TLS 1.2 which I've characterized as "Fly-casual-this-is-TLS-1.3" and is not in reality an extension at all. Among the worst problems is that both cheap "We'll talk again soon" key agreement avoidance optimisations in TLS 1.2 are effectively security holes by design. However generally the problem in SSL and TLS up to 1.2 was that they're designed by software engineers who know some cryptography and then some real cryptographers are brought in at the end to check it works. Like having the civil engineer give your bridge design a once over after some non-engineers have made the plans it's just too late to do a proper job. "This bridge will definitely collapse and kill everyone" is avoidable, but "I dunno, this seems like a bad idea, I wouldn't do it that way" just gets ignored as too late. TLS 1.3 is the first version where cryptographers had actually proved it works before the protocol was set in stone. Now, the proof has a small misunderstanding (called the "Selfie" attack, it's not relevant to a web browser but people doing low-level peer-to-peer type stuff need to understand it before using TLS at all) but having it at all was a huge difference.

DarkUranium 2mo ago
TIL that TLS (before 1.3) was designed by non-cryptographers. What the hell.
- ivanr 2mo ago
  You could argue that it was designed by one guy (Kipp Hickman) in three months: https://www.feistyduck.com/newsletter/issue_131_the_legend_of_kipp_hickman https://www.feistyduck.com/newsletter/issue_131_the_legend_o...
- tialaramex 2mo ago
  I shouldn't undersell it quite as much as I did, the original SSL concept comes from Taher Elgamal who was ex-RSA and had published the cryptosystem named after him. So it's not really true that there aren't any cryptographers in the room. However more importantly what TLS (and earlier SSL) wants to do is extremely hard and once Javascript comes into the picture it's ludicrously harder for this to deliver security than basically any system ordinary people have used. Several "But obviously I would never do that" scenarios you'd learn about in a cryptography class like "What if your adversary can control part of the messages to be encrypted?" or "What if your adversary can force you to transmit the same exact message thousands or millions of times?" are routine requirements of security for HTTPS because of how the Web works. And for SSL in particular why would math people (which is what cryptographers are) even be interested? 30+ Years Ago Tim's hypermedia system is just a toy and while its name, "World Wide Web" does sound like a big deal it's not actually important to your everyday life. If you live in a big city and it has a "web page" on Tim's system it's probably knocked together by some IT nerd who works for the city and the actual local government have no idea what a "web page" even is. Probably by the time TLS 1.2 shipped, the relevant IETF Working Group (also named TLS) could have reached out and asked cryptography researchers to help first and got some engagement because it's obvious this is a big deal, but that didn't happen until TLS 1.3