Re: Albrecht/Paterson/Watson's attack

Mouse <[email protected]> writes:

> Besides the obvious suggestions made in the paper (basically "don't
> use CBC bulk ciphers"), it occurs to me that there is another defense:
> make it hard to identify packet boundaries by, whenever the connection
> would otherwise go idle, generating an IGNORE packet and sending only
> part of it, holding the rest until something more is available to be
> sent on that connection.

Another alternative is to use an encrypt-then-mac approach.

http://tools.ietf.org/html/draft-gutmann-tls-encrypt-then-mac-05

which has a normative reference to:

    Krawczyk, H., "The Order of Encryption and Authentication
    for Protecting Communications (or: How Secure Is SSL?)",
    Springer-Verlag LNCS 2139, August 2001.

fwiw: I believe that OpenSSL extensions to KEX_DEFAULT_MAC do this:

	"[email protected]," \
	"[email protected]," \
	"[email protected]," \
	"[email protected]," \
	"[email protected]," \
	"[email protected]," \
	"[email protected]," \
	"[email protected]," \
	"[email protected]," \

which seems to work for them. I don't know if we want to try to make the
-etm alternatives available as a part of the SSHv2 defined set of MACs.

	-- Mark