Tighten up ticketer decryption #2022

ctz · 2024-06-24T16:16:18Z

These changes aim to make it harder to mount any theoretical attack against AEAD decryption due to the AEADs we use being not key-committing. The best current attacks against this aren't better than brute force, so there is no security issue here.

The last commit is a little unrelated, but is along for the ride after I noticed the poor error in the test changed in the second commit.

fixes #2023

rustls-benchmarking · 2024-06-24T16:19:39Z

Benchmark results

Instruction counts

Significant differences

⚠️ There are significant instruction count differences

Click to expand

Scenario	Baseline	Candidate	Diff	Threshold
handshake_tickets_aws_lc_rs_1.3_rsa_aes_server	33163096	33588046	⚠️ 424950 (1.28%)	0.61%
handshake_tickets_aws_lc_rs_1.3_ecdsap256_aes_server	33221580	33549116	⚠️ 327536 (0.99%)	0.20%
handshake_tickets_aws_lc_rs_1.3_ecdsap384_aes_server	33222568	33550054	⚠️ 327486 (0.99%)	0.20%
handshake_tickets_aws_lc_rs_1.3_ecdsap384_chacha_server	33196782	33516187	⚠️ 319405 (0.96%)	0.20%
handshake_tickets_aws_lc_rs_1.3_ecdsap256_chacha_server	33197392	33515008	⚠️ 317616 (0.96%)	0.20%
handshake_tickets_aws_lc_rs_1.3_ecdsap384_aes_client	30841898	31132259	⚠️ 290361 (0.94%)	0.30%
handshake_tickets_aws_lc_rs_1.3_ecdsap384_chacha_client	30838410	31109128	⚠️ 270718 (0.88%)	0.37%
handshake_tickets_aws_lc_rs_1.3_rsa_chacha_client	30861994	31131073	⚠️ 269079 (0.87%)	0.20%
handshake_tickets_aws_lc_rs_1.3_ecdsap256_chacha_client	30844988	31111655	⚠️ 266667 (0.86%)	0.20%
handshake_tickets_aws_lc_rs_1.3_ecdsap256_aes_client	30867343	31134171	⚠️ 266828 (0.86%)	0.20%
handshake_tickets_aws_lc_rs_1.3_rsa_aes_client	30885703	31151693	⚠️ 265990 (0.86%)	0.20%
handshake_tickets_aws_lc_rs_1.3_rsa_chacha_server	33246813	33515082	⚠️ 268269 (0.81%)	0.60%
handshake_tickets_ring_1.3_ecdsap256_aes_server	43734782	44046272	⚠️ 311490 (0.71%)	0.20%
handshake_tickets_ring_1.3_ecdsap384_aes_server	43734802	44041098	⚠️ 306296 (0.70%)	0.20%
handshake_tickets_ring_1.3_rsa_aes_server	43733383	44037248	⚠️ 303865 (0.69%)	0.20%
handshake_tickets_ring_1.3_rsa_chacha_server	43655518	43953875	⚠️ 298357 (0.68%)	0.20%
handshake_tickets_ring_1.3_ecdsap256_chacha_server	43659057	43957128	⚠️ 298071 (0.68%)	0.20%
handshake_tickets_ring_1.3_ecdsap384_chacha_server	43658805	43956476	⚠️ 297671 (0.68%)	0.20%
handshake_tickets_ring_1.3_ecdsap384_chacha_client	41997448	42267363	⚠️ 269915 (0.64%)	0.20%
handshake_tickets_ring_1.3_ecdsap256_aes_client	42072182	42342309	⚠️ 270127 (0.64%)	0.20%
handshake_tickets_ring_1.3_ecdsap256_chacha_client	42004280	42273609	⚠️ 269329 (0.64%)	0.20%
handshake_tickets_ring_1.3_rsa_chacha_client	42015882	42284836	⚠️ 268954 (0.64%)	0.20%
handshake_tickets_ring_1.3_ecdsap384_aes_client	42067266	42333046	⚠️ 265780 (0.63%)	0.20%
handshake_tickets_ring_1.3_rsa_aes_client	42084937	42350088	⚠️ 265151 (0.63%)	0.20%
handshake_tickets_ring_1.2_rsa_aes_server	4678475	4690574	⚠️ 12099 (0.26%)	0.20%
handshake_session_id_aws_lc_rs_1.2_rsa_aes_client	3991772	4000343	⚠️ 8571 (0.21%)	0.20%

Other differences

Click to expand

Scenario	Baseline	Candidate	Diff	Threshold
handshake_session_id_aws_lc_rs_1.2_rsa_aes_server	3908155	4007070	98915 (2.53%)	5.51%
handshake_session_id_aws_lc_rs_1.3_rsa_aes_server	32899452	33029448	129996 (0.40%)	0.60%
handshake_no_resume_aws_lc_rs_1.3_rsa_aes_server	13791718	13740277	-51441 (-0.37%)	1.01%
handshake_no_resume_aws_lc_rs_1.3_ecdsap384_aes_client	8800375	8771380	-28995 (-0.33%)	1.11%
handshake_tickets_aws_lc_rs_1.2_rsa_aes_server	4449404	4463690	14286 (0.32%)	3.62%
handshake_no_resume_aws_lc_rs_1.2_rsa_aes_server	13397474	13354886	-42588 (-0.32%)	0.84%
handshake_no_resume_aws_lc_rs_1.3_rsa_chacha_server	13766228	13798106	31878 (0.23%)	0.92%
handshake_session_id_aws_lc_rs_1.3_ecdsap384_aes_client	30620475	30683691	63216 (0.21%)	0.42%
handshake_session_id_ring_1.2_rsa_aes_client	4256080	4264351	8271 (0.19%)	0.20%
handshake_session_id_ring_1.2_rsa_aes_server	4243954	4250766	6812 (0.16%)	0.20%
handshake_tickets_aws_lc_rs_1.2_rsa_aes_client	4318265	4323855	5590 (0.13%)	0.20%
handshake_session_id_aws_lc_rs_1.3_rsa_chacha_server	32908716	32940026	31310 (0.10%)	0.57%
transfer_no_resume_aws_lc_rs_1.2_rsa_aes_server	46382835	46423593	40758 (0.09%)	0.40%
handshake_tickets_ring_1.2_rsa_aes_client	4525424	4528675	3251 (0.07%)	0.20%
handshake_session_id_aws_lc_rs_1.3_ecdsap256_aes_server	32959305	32980419	21114 (0.06%)	0.20%
handshake_session_id_aws_lc_rs_1.3_ecdsap384_chacha_server	32918197	32939076	20879 (0.06%)	0.20%
handshake_session_id_aws_lc_rs_1.3_ecdsap256_chacha_server	32917998	32938521	20523 (0.06%)	0.20%
handshake_session_id_aws_lc_rs_1.3_ecdsap384_aes_server	32959101	32979048	19947 (0.06%)	0.20%
transfer_no_resume_aws_lc_rs_1.3_rsa_aes_server	46440482	46467345	26863 (0.06%)	0.34%
handshake_no_resume_aws_lc_rs_1.3_ecdsap384_chacha_client	8765767	8769795	4028 (0.05%)	0.73%
transfer_no_resume_aws_lc_rs_1.3_ecdsap384_aes_server	46431802	46452403	20601 (0.04%)	0.20%
transfer_no_resume_aws_lc_rs_1.3_ecdsap256_aes_server	46432379	46452863	20484 (0.04%)	0.20%
transfer_no_resume_aws_lc_rs_1.3_ecdsap384_aes_client	58226800	58251326	24526 (0.04%)	0.20%
handshake_session_id_ring_1.3_ecdsap384_chacha_server	43349391	43365752	16361 (0.04%)	0.20%
handshake_session_id_ring_1.3_ecdsap256_chacha_server	43350732	43366832	16100 (0.04%)	0.20%
handshake_session_id_ring_1.3_rsa_chacha_server	43347108	43362888	15780 (0.04%)	0.20%
handshake_session_id_ring_1.3_ecdsap384_aes_server	43452343	43467091	14748 (0.03%)	0.20%
handshake_session_id_ring_1.3_ecdsap256_aes_server	43453753	43468125	14372 (0.03%)	0.20%
handshake_session_id_ring_1.3_rsa_aes_server	43450220	43464118	13898 (0.03%)	0.20%
transfer_no_resume_aws_lc_rs_1.3_ecdsap256_chacha_server	80611565	80632392	20827 (0.03%)	0.20%
transfer_no_resume_aws_lc_rs_1.3_ecdsap384_chacha_server	80611082	80631758	20676 (0.03%)	0.20%
transfer_no_resume_aws_lc_rs_1.3_rsa_chacha_server	80631389	80613164	-18225 (-0.02%)	0.22%
handshake_no_resume_ring_1.2_rsa_aes_client	2853345	2853931	586 (0.02%)	0.20%
handshake_no_resume_aws_lc_rs_1.3_ecdsap256_chacha_server	1915162	1915547	385 (0.02%)	0.20%
handshake_session_id_aws_lc_rs_1.3_rsa_aes_client	30681138	30687055	5917 (0.02%)	0.20%
handshake_session_id_aws_lc_rs_1.3_ecdsap256_chacha_client	30641554	30646822	5268 (0.02%)	0.20%
handshake_no_resume_aws_lc_rs_1.3_ecdsap256_chacha_client	3385223	3385768	545 (0.02%)	0.26%
handshake_session_id_ring_1.3_rsa_chacha_client	41815489	41821583	6094 (0.01%)	0.20%
handshake_session_id_aws_lc_rs_1.3_ecdsap256_aes_client	30665570	30669936	4366 (0.01%)	0.20%
handshake_session_id_ring_1.3_ecdsap256_chacha_client	41804471	41810395	5924 (0.01%)	0.20%
handshake_session_id_ring_1.3_ecdsap256_aes_client	41883291	41889071	5780 (0.01%)	0.20%
handshake_session_id_aws_lc_rs_1.3_rsa_chacha_client	30655063	30659282	4219 (0.01%)	0.20%
handshake_session_id_ring_1.3_rsa_aes_client	41896397	41901920	5523 (0.01%)	0.20%
handshake_session_id_ring_1.3_ecdsap384_chacha_client	41797505	41802709	5204 (0.01%)	0.20%
transfer_no_resume_ring_1.3_ecdsap256_aes_server	46457927	46463022	5095 (0.01%)	0.20%
handshake_no_resume_ring_1.3_ecdsap256_aes_server	2130959	2131179	220 (0.01%)	0.84%
handshake_session_id_ring_1.3_ecdsap384_aes_client	41878728	41882975	4247 (0.01%)	0.20%
handshake_no_resume_ring_1.3_ecdsap256_chacha_server	2133054	2133257	203 (0.01%)	0.77%
transfer_no_resume_ring_1.3_ecdsap256_aes_client	58317118	58322629	5511 (0.01%)	0.20%
handshake_no_resume_ring_1.3_ecdsap256_aes_client	3915860	3916140	280 (0.01%)	0.45%
handshake_no_resume_aws_lc_rs_1.3_ecdsap256_aes_client	3382237	3382456	219 (0.01%)	0.24%
handshake_no_resume_aws_lc_rs_1.3_rsa_aes_client	2226939	2227080	141 (0.01%)	0.20%
transfer_no_resume_ring_1.3_ecdsap256_chacha_client	92652378	92657659	5281 (0.01%)	0.20%
transfer_no_resume_ring_1.3_ecdsap256_chacha_server	80526617	80530883	4266 (0.01%)	0.20%
handshake_no_resume_aws_lc_rs_1.3_ecdsap384_aes_server	4291450	4291627	177 (0.00%)	0.20%
handshake_no_resume_ring_1.3_rsa_aes_client	2950747	2950864	117 (0.00%)	0.20%
handshake_no_resume_ring_1.3_ecdsap256_chacha_client	3915762	3915618	-144 (-0.00%)	0.35%
transfer_no_resume_aws_lc_rs_1.3_ecdsap256_chacha_client	92712910	92716061	3151 (0.00%)	0.20%
handshake_no_resume_ring_1.3_rsa_aes_server	12176608	12177019	411 (0.00%)	0.20%
handshake_no_resume_aws_lc_rs_1.3_rsa_chacha_client	2234315	2234383	68 (0.00%)	0.20%
transfer_no_resume_aws_lc_rs_1.3_rsa_aes_client	58261139	58262879	1740 (0.00%)	0.20%
handshake_no_resume_aws_lc_rs_1.3_ecdsap384_chacha_server	4294831	4294945	114 (0.00%)	0.20%
handshake_no_resume_ring_1.3_ecdsap384_aes_server	13739300	13739612	312 (0.00%)	0.20%
transfer_no_resume_ring_1.3_ecdsap384_aes_client	58314172	58315453	1281 (0.00%)	0.20%
handshake_no_resume_ring_1.3_rsa_chacha_server	12182782	12183037	255 (0.00%)	0.20%
handshake_session_id_aws_lc_rs_1.3_ecdsap384_chacha_client	30661004	30660410	-863 (-0.00%)	0.31%
transfer_no_resume_aws_lc_rs_1.3_ecdsap256_aes_client	58257641	58256517	-1124 (-0.00%)	0.20%
handshake_no_resume_ring_1.3_ecdsap384_chacha_server	13741287	13741532	245 (0.00%)	0.20%
transfer_no_resume_ring_1.3_rsa_aes_client	58318093	58319019	926 (0.00%)	0.20%
transfer_no_resume_ring_1.3_rsa_chacha_client	92650631	92652097	1466 (0.00%)	0.20%
transfer_no_resume_aws_lc_rs_1.3_rsa_chacha_client	92717950	92719353	1403 (0.00%)	0.20%
transfer_no_resume_ring_1.3_ecdsap384_chacha_client	92646265	92647624	1359 (0.00%)	0.20%
transfer_no_resume_aws_lc_rs_1.2_rsa_aes_client	68657355	68658216	861 (0.00%)	0.20%
transfer_no_resume_ring_1.3_rsa_aes_server	46470762	46470232	-530 (-0.00%)	0.20%
handshake_no_resume_aws_lc_rs_1.3_ecdsap256_aes_server	1912475	1912454	-21 (-0.00%)	0.20%
handshake_no_resume_aws_lc_rs_1.2_rsa_aes_client	2016339	2016361	22 (0.00%)	0.20%
transfer_no_resume_aws_lc_rs_1.3_ecdsap384_chacha_client	92717918	92718530	612 (0.00%)	0.20%
transfer_no_resume_ring_1.3_ecdsap384_aes_server	46461171	46461446	275 (0.00%)	0.20%
transfer_no_resume_ring_1.3_rsa_chacha_server	80538538	80539001	463 (0.00%)	0.20%
transfer_no_resume_ring_1.2_rsa_aes_client	58199868	58200172	304 (0.00%)	0.20%
transfer_no_resume_ring_1.2_rsa_aes_server	46376025	46375874	-151 (-0.00%)	0.20%
handshake_no_resume_ring_1.3_ecdsap384_aes_client	35473302	35473363	61 (0.00%)	0.20%
transfer_no_resume_ring_1.3_ecdsap384_chacha_server	80530068	80530192	124 (0.00%)	0.20%
handshake_no_resume_ring_1.3_ecdsap384_chacha_client	35475500	35475448	-52 (-0.00%)	0.20%
handshake_no_resume_ring_1.3_rsa_chacha_client	2956476	2956480	4 (0.00%)	0.20%
handshake_no_resume_ring_1.2_rsa_aes_server	11988483	11988497	14 (0.00%)	0.20%

Wall-time

Significant differences

There are no significant wall-time differences

Other differences

Click to expand

Scenario	Baseline	Candidate	Diff	Threshold
handshake_no_resume_aws_lc_rs_1.3_rsa_aes	1.44 ms	1.41 ms	-0.03 ms (-1.99%)	2.82%
handshake_no_resume_aws_lc_rs_1.2_rsa_aes	1.39 ms	1.36 ms	-0.03 ms (-1.99%)	2.16%
handshake_no_resume_aws_lc_rs_1.3_rsa_chacha	1.43 ms	1.41 ms	-0.03 ms (-1.96%)	3.07%
transfer_no_resume_aws_lc_rs_1.2_rsa_aes	5.54 ms	5.45 ms	-0.09 ms (-1.55%)	3.39%
transfer_no_resume_aws_lc_rs_1.3_rsa_aes	5.55 ms	5.47 ms	-0.08 ms (-1.48%)	3.81%
transfer_no_resume_aws_lc_rs_1.3_ecdsap256_aes	4.59 ms	4.53 ms	-0.06 ms (-1.27%)	4.27%
transfer_no_resume_aws_lc_rs_1.3_ecdsap384_aes	5.31 ms	5.25 ms	-0.06 ms (-1.16%)	3.69%
handshake_no_resume_ring_1.3_ecdsap256_chacha	510.29 µs	505.21 µs	-5.07 µs (-0.99%)	2.28%
handshake_session_id_aws_lc_rs_1.2_rsa_aes	2.09 ms	2.07 ms	-0.02 ms (-0.97%)	1.32%
handshake_session_id_ring_1.3_ecdsap256_chacha	6.74 ms	6.67 ms	-0.06 ms (-0.95%)	1.00%
handshake_no_resume_ring_1.3_ecdsap256_aes	512.57 µs	507.73 µs	-4.84 µs (-0.95%)	2.46%
handshake_session_id_ring_1.3_ecdsap256_aes	6.78 ms	6.71 ms	-0.06 ms (-0.94%)	1.00%
transfer_no_resume_ring_1.3_ecdsap256_aes	6.41 ms	6.35 ms	-0.06 ms (-0.93%)	3.03%
transfer_no_resume_ring_1.3_rsa_aes	6.90 ms	6.83 ms	-0.06 ms (-0.92%)	2.93%
transfer_no_resume_ring_1.2_rsa_aes	6.84 ms	6.78 ms	-0.06 ms (-0.88%)	2.45%
handshake_no_resume_aws_lc_rs_1.3_ecdsap256_aes	487.37 µs	483.46 µs	-3.91 µs (-0.80%)	2.77%
handshake_no_resume_aws_lc_rs_1.3_ecdsap256_chacha	486.12 µs	482.25 µs	-3.87 µs (-0.80%)	2.80%
handshake_no_resume_ring_1.3_rsa_chacha	995.20 µs	988.19 µs	-7.01 µs (-0.70%)	1.10%
handshake_session_id_ring_1.3_rsa_chacha	7.22 ms	7.17 ms	-0.05 ms (-0.70%)	1.00%
handshake_tickets_ring_1.3_ecdsap256_aes	6.81 ms	6.77 ms	-0.05 ms (-0.69%)	1.00%
handshake_session_id_ring_1.3_rsa_aes	7.26 ms	7.21 ms	-0.05 ms (-0.68%)	1.00%
transfer_no_resume_aws_lc_rs_1.3_rsa_chacha	14.02 ms	13.93 ms	-0.09 ms (-0.66%)	1.63%
handshake_tickets_ring_1.2_rsa_aes	1.64 ms	1.65 ms	0.01 ms (0.66%)	1.00%
handshake_tickets_ring_1.3_ecdsap256_chacha	6.77 ms	6.72 ms	-0.04 ms (-0.62%)	1.00%
transfer_no_resume_ring_1.3_ecdsap384_aes	9.51 ms	9.45 ms	-0.06 ms (-0.59%)	2.01%
handshake_no_resume_ring_1.3_rsa_aes	994.47 µs	988.81 µs	-5.66 µs (-0.57%)	1.10%
handshake_session_id_ring_1.3_ecdsap384_aes	9.86 ms	9.80 ms	-0.05 ms (-0.55%)	1.00%
handshake_session_id_ring_1.3_ecdsap384_chacha	9.82 ms	9.77 ms	-0.05 ms (-0.54%)	1.00%
handshake_tickets_aws_lc_rs_1.3_ecdsap384_aes	6.10 ms	6.13 ms	0.03 ms (0.53%)	1.84%
transfer_no_resume_ring_1.3_rsa_chacha	13.55 ms	13.48 ms	-0.07 ms (-0.52%)	1.25%
handshake_session_id_aws_lc_rs_1.3_rsa_chacha	6.34 ms	6.31 ms	-0.03 ms (-0.51%)	1.44%
transfer_no_resume_aws_lc_rs_1.3_ecdsap384_chacha	13.77 ms	13.70 ms	-0.07 ms (-0.51%)	1.43%
handshake_tickets_ring_1.3_rsa_aes	7.30 ms	7.26 ms	-0.04 ms (-0.50%)	1.00%
transfer_no_resume_aws_lc_rs_1.3_ecdsap256_chacha	13.06 ms	12.99 ms	-0.06 ms (-0.49%)	1.53%
transfer_no_resume_ring_1.3_ecdsap256_chacha	13.06 ms	13.00 ms	-0.06 ms (-0.46%)	1.35%
handshake_session_id_aws_lc_rs_1.3_rsa_aes	6.35 ms	6.32 ms	-0.03 ms (-0.46%)	1.54%
handshake_session_id_ring_1.2_rsa_aes	1.56 ms	1.57 ms	0.01 ms (0.45%)	1.00%
handshake_tickets_aws_lc_rs_1.3_ecdsap256_aes	5.39 ms	5.42 ms	0.02 ms (0.45%)	2.02%
handshake_tickets_aws_lc_rs_1.3_ecdsap384_chacha	6.11 ms	6.13 ms	0.02 ms (0.41%)	1.57%
handshake_no_resume_ring_1.2_rsa_aes	983.13 µs	979.25 µs	-3.88 µs (-0.39%)	1.07%
transfer_no_resume_ring_1.3_ecdsap384_chacha	16.15 ms	16.09 ms	-0.06 ms (-0.38%)	1.20%
handshake_tickets_aws_lc_rs_1.3_ecdsap256_chacha	5.40 ms	5.42 ms	0.02 ms (0.37%)	2.02%
handshake_tickets_ring_1.3_ecdsap384_aes	9.89 ms	9.86 ms	-0.03 ms (-0.35%)	1.00%
handshake_tickets_ring_1.3_rsa_chacha	7.24 ms	7.22 ms	-0.02 ms (-0.34%)	1.00%
handshake_no_resume_aws_lc_rs_1.3_ecdsap384_chacha	1.19 ms	1.19 ms	-0.00 ms (-0.27%)	1.13%
handshake_tickets_ring_1.3_ecdsap384_chacha	9.85 ms	9.82 ms	-0.03 ms (-0.27%)	1.00%
handshake_no_resume_aws_lc_rs_1.3_ecdsap384_aes	1.20 ms	1.20 ms	-0.00 ms (-0.26%)	1.00%
handshake_tickets_aws_lc_rs_1.2_rsa_aes	2.25 ms	2.25 ms	-0.00 ms (-0.16%)	1.04%
handshake_session_id_aws_lc_rs_1.3_ecdsap256_chacha	5.37 ms	5.37 ms	-0.01 ms (-0.13%)	1.50%
handshake_tickets_aws_lc_rs_1.3_rsa_chacha	6.38 ms	6.37 ms	-0.01 ms (-0.10%)	1.50%
handshake_no_resume_ring_1.3_ecdsap384_chacha	3.60 ms	3.60 ms	-0.00 ms (-0.09%)	1.00%
handshake_session_id_aws_lc_rs_1.3_ecdsap384_aes	6.09 ms	6.09 ms	0.00 ms (0.07%)	1.41%
handshake_session_id_aws_lc_rs_1.3_ecdsap256_aes	5.37 ms	5.38 ms	0.00 ms (0.06%)	1.70%
handshake_tickets_aws_lc_rs_1.3_rsa_aes	6.36 ms	6.37 ms	0.00 ms (0.05%)	1.59%
handshake_no_resume_ring_1.3_ecdsap384_aes	3.60 ms	3.60 ms	-0.00 ms (-0.05%)	1.00%
handshake_session_id_aws_lc_rs_1.3_ecdsap384_chacha	6.07 ms	6.07 ms	-0.00 ms (-0.04%)	1.42%

Additional information

Historical results

Checkout details:

Base repo: https://github.com/rustls/rustls.git
Base branch: main (325a6b6)
Candidate repo: https://github.com/rustls/rustls.git
Candidate branch: jbp-tighten-up-ticketer-decryption (81b68f4)

codecov · 2024-06-24T16:20:04Z

Codecov Report

Attention: Patch coverage is 98.70130% with 1 line in your changes missing coverage. Please review.

Project coverage is 94.25%. Comparing base (185cc71) to head (81b68f4).
Report is 3 commits behind head on main.

Files	Patch %	Lines
rustls/src/crypto/ring/ticketer.rs	98.27%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2022       /-   ##
==========================================
  Coverage   94.24%   94.25%    0.01%     
==========================================
  Files          97       97              
  Lines       21724    21787       63     
==========================================
  Hits        20473    20535       62     
- Misses       1251     1252        1

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

cpu

Looks good to me, just two non-blocking comments/questions.

rustls/src/crypto/ring/ticketer.rs

rustls/src/msgs/codec.rs

See RFC5077 for the semantics and purpose of this. Included it in the AAD, but also early-reject incorrect values. This is belt-and-braces, we could remove either without a security problem. This should slightly improve the performance of `TicketSwitcher`. Note that `key_name` is not really a secret: tickets are issued and offered in plaintext in TLS1.2, and issued privately but offered in plaintext in TLS1.3. Therefore it is visible to an attacker in privileged network position, or able to complete a handshake with the server.

It is impossible in this interface for the caller to notice that trailing data was present (compared to `Codec::read`), so this function must do it. The immediate impetus for this change is the usage of `ServerSessionValue::read_bytes()` after ticket decryption. Fix a test in handshake_test that was sensitive to this.

ctz marked this pull request as draft June 25, 2024 12:32

ctz mentioned this pull request Jun 25, 2024

Partitioning Oracle Attacks against TLS Session Tickets #2023

Closed

ctz force-pushed the jbp-tighten-up-ticketer-decryption branch from 827b6f1 to 25eca49 Compare June 25, 2024 14:41

ctz marked this pull request as ready for review June 25, 2024 14:41

cpu approved these changes Jun 25, 2024

View reviewed changes

rustls/src/crypto/ring/ticketer.rs Outdated Show resolved Hide resolved

rustls/src/crypto/ring/ticketer.rs Show resolved Hide resolved

djc approved these changes Jun 26, 2024

View reviewed changes

ctz force-pushed the jbp-tighten-up-ticketer-decryption branch from 25eca49 to 2640200 Compare June 26, 2024 15:50

ctz added 4 commits June 26, 2024 16:58

ticketer: reject ciphertexts longer than we produced

c00fd1f

Improve error specificity for excess-size certificates

81b68f4

ctz force-pushed the jbp-tighten-up-ticketer-decryption branch from 2640200 to 81b68f4 Compare June 26, 2024 16:03

djc approved these changes Jun 27, 2024

View reviewed changes

ctz added this pull request to the merge queue Jun 27, 2024

Merged via the queue into main with commit cf0c947 Jun 27, 2024
46 checks passed

ctz deleted the jbp-tighten-up-ticketer-decryption branch June 27, 2024 11:53

cpu mentioned this pull request Jul 8, 2024

Prepare 0.23.11 #2037

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Tighten up ticketer decryption #2022

Tighten up ticketer decryption #2022

ctz commented Jun 24, 2024 •

edited

Loading

rustls-benchmarking bot commented Jun 24, 2024 •

edited

Loading

codecov bot commented Jun 24, 2024 •

edited

Loading

cpu left a comment

Tighten up ticketer decryption #2022

Tighten up ticketer decryption #2022

Conversation

ctz commented Jun 24, 2024 • edited Loading

rustls-benchmarking bot commented Jun 24, 2024 • edited Loading

Benchmark results

Instruction counts

Significant differences

Other differences

Wall-time

Significant differences

Other differences

Additional information

codecov bot commented Jun 24, 2024 • edited Loading

Codecov Report

cpu left a comment

Choose a reason for hiding this comment

ctz commented Jun 24, 2024 •

edited

Loading

rustls-benchmarking bot commented Jun 24, 2024 •

edited

Loading

codecov bot commented Jun 24, 2024 •

edited

Loading