Mauritian code-cutters to help deliver TLS 1.3 When IETF 100's hackathon kicks off in Singapore, one of the groups hoping to make waves will come from Mauritius. Their aim, Logan Velvindron of hackers.mu told Vulture South, is twofold: to make serious contributions to the development of the as-yet-immature TLS 1.3, and along the way, break Mauritius out of its public image …
Its also broken by design so that users can't plug in their own block cipher, hash or public key encryption. The days of enumerating a few options just to save a byte in a startup packet are long gone and the concepts of plug in ciphers are well known and offer options once something falls to the crypto gods. If my client and server want to do AES512 with 20 rounds, the protocol should allow me to add a config line saying prefer "AES512_20rounds-GCM-SHA512_160rounds" without breaking anything. Right now, the client and server software need to be hacked, and ID type that will conflict in the future will need to be added, the crypto libraries need to be updated and then everything has to be recompiled. That process is why there are so many broken systems out on the web today.
First lets look at SSL/TLS and why it is Broken By Design:
* enormous complexity which means lots of lines of code. Between 30000(Google's TLS) and 400000 lines of code (OpenSSL). ALL major implementations have had exploitable bugs in the past couple of years.
* depends on the security of Certificate Authorities
* requires Public Key cryptography as an added bonus of complexity (and potential weakness)
Talk is cheap, can I do it better ? Here is my attempt:
https://github.com/DiplIngFrankGerlach/MST
+ less than 1000 lines of code. That means: any competent crypto software engineer can usefully review it
+ All SSL/TLS assurances
+ No public key crypto. Your bank/telco/utility company/stock broker can send you an envelope with a 16 byte key. If you do not trust the post office, visit said institution's branch office to collect the key.
"No public key crypto. Your bank/telco/utility company/stock broker can send you an envelope with a 16 byte key. If you do not trust the post office, visit said institution's branch office to collect the key."
Yes, this seems likely to be done by the average person on the street . . . as soon as monkeys fly out of my butt.
So what you are saying is that users cannot be bothered to enter 16 octets of key, because they would miss 3 minutes of "what are the Kardashians up to ?".
Also, MSFT license keys are quite similar to the keys of MST. Nobody had a problem to enter them.
Yes, that is exactly what I am saying. No one except the sort of person who keeps pee in jars will be entering 16 octets of key by hand. You almost have a point with Microsoft license keys, but those are a) mostly distributed electronically now, so they can be copied and pasted, b) they arrive with the product you're going to use, and c) the average person, again, will say "$OtherBank doesn't require this tedious manual crap, I'll just go with them."
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
