implement stateless resets #141

marten-seemann · 2017-11-08T03:38:41Z

This PR changes the server state machine such that sending HelloRetryRequests can be performed statelessly.

In non-blocking mode, Handshake() will return a new alert, AlertStatelessRetry. When receiving this return, an app can discard all mint-related state (i.e. delete Conn garbage collected). When not using non-blocking mode, the handshake is performed as stateless as possible, at no point the initial ClientHello and the HelloRetryRequest will be stored.

The cookie that is sent to the client in the HelloRetryRequest is composed of two parts: In the mint-part of the cookie, we store the hash of the initial ClientHello. The second part can be used to store an application-defined cookie (used when Config.CookieHandler is set). The application has to provide a way to encrypt this cookie (it should use authenticated encryption for this). This can be done by setting Config.CookieSource. In blocking mode, we default to use AES-GCM if no CookieSource is set.

@ekr, @bifurcation: Please tell me what you think about this. The stateless handshake works for me with this PR, but I can't guarantee I didn't miss anything subtle here. My current understanding of the TLS 1.3 draft doesn't go a lot farther than what I need for my mint changes and the QUIC integration.

ekr · 2017-11-08T18:28:26Z

@marten-seemann this seems to fail in CI...

ekr

I haven't reviewed the tests yet.
This seems generally sound structurally, but I had technical comments about the internals.

I can review the tests once they work in CI

ekr · 2017-11-08T18:34:53Z

alert.go

@@ -82,6 +83,7 @@ var alertText = map[Alert]string{
 	AlertUnknownPSKIdentity:          "unknown PSK identity",
 	AlertNoApplicationProtocol:       "no application protocol",
 	AlertNoRenegotiation:             "no renegotiation",
+	AlertStatelessRetry:              "stateless retry",


This isn't your fault, but I wonder if we should give these non-alerts a special name so we don't acccidentally try to send them.

ekr · 2017-11-08T18:36:17Z

conn.go

@@ -74,9 +74,16 @@ type Config struct {
 	AllowEarlyData     bool
 	// Require the client to echo a cookie.
 	RequireCookie bool
+	// TODO: fix comment here: no more default cookie handler


This TODO seems like it needs fixing.

ekr · 2017-11-08T18:36:24Z

conn.go

+	// The CookieSource is used to encrypt / decrypt cookies.
+	// TODO: implement a check for that
+	// If non-blocking mode is used, and cookies are required, this field has to be set.
+	// TODO: implement that


These TODOs also seem to need fixing

ekr · 2017-11-08T18:37:14Z

conn.go

+			var err error
+			caps.CookieSource, err = newDefaultCookieSource()
+			if err != nil {
+				logf(logTypeHandshake, "Error initializing client state: %v", alert)


Should this say server state?

ekr · 2017-11-08T18:38:05Z

conn.go

@@ -687,6 +706,7 @@ func (c *Conn) Handshake() Alert {

 	for !connected {
 		// Read a handshake message
+		logf(logTypeHandshake, "readmessage")


Maybe make this |logTypeVerbose| and make the text clearer.

ekr · 2017-11-08T18:50:09Z

server-state-machine.go

+		plainCookie, err := state.Caps.CookieSource.DecodeToken(clientCookie.Cookie)
+		if err != nil {
+			logf(logTypeHandshake, fmt.Sprintf("[ServerStateStart] Error decoding token [%v]", err))
+			return nil, nil, AlertAccessDenied


I don't think you want AccessDenied here, but rather DecryptError or IllegalParameter

I would put a TODO here because if you were to change your key, this wouldn't work.

ekr · 2017-11-08T18:50:28Z

server-state-machine.go

+		if _, err := syntax.Unmarshal(plainCookie, cookie); err != nil {
+			logf(logTypeHandshake, fmt.Sprintf("[ServerStateStart] Error unmarshaling cookie [%v]", err))
+			return nil, nil, AlertAccessDenied
+		}


This should be internal_error, because it can't happen.

ekr · 2017-11-08T18:51:56Z

server-state-machine.go

-			logf(logTypeHandshake, "[ServerStateStart] Error computing truncated ClientHello [%v]", err)
-			return nil, nil, AlertDecodeError
+			logf(logTypeHandshake, "[ServerStateStart] Error in PSK negotiation [%v]", err)
+			return nil, nil, AlertInternalError


I am surprised this is internal error. @bifurcation ?

ekr · 2017-11-08T18:52:48Z

server-state-machine.go

+			binder := computeFinishedData(params, binderKey, ctxHash.Sum(nil))
+			if !bytes.Equal(binder, clientPSK.Binders[selectedPSK].Binder) {
+				logf(logTypeNegotiation, "Binder check failed for identity %x; [%x] != [%x]", psk.Identity, binder, clientPSK.Binders[selectedPSK].Binder)
+				return nil, nil, AlertInternalError


This seems like decrypt_error.

ekr · 2017-11-08T18:54:48Z

server-state-machine.go

+					logf(logTypeHandshake, "[ServerStateStart] Error generating cookie [%v]", err)
+					return nil, nil, AlertInternalError
+				}
+				shouldSendHRR = appCookie != nil


Is this idiomatic go? I would have done if....

marten-seemann · 2017-11-09T07:07:18Z

Hi, @ekr thanks for the review! Seems like I forgot a bunch of TODOs and a few debug statements. I removed those, and added a bunch of documentation about Cookies, CookieSources and CookieHandler.
The reason the tests were failing is that CircleCI apparently uses Go 1.8 if no config file is provided, and the test helper functions (t.Helper()) require Go 1.9. I added a basic config file.

I really like the idea of storing the negotiated parameters in the cookie as well. By doing so, I was able to remove a rather ugly hack that was necessary to make PSK mode work. Is there anything else besides the CipherSuite that we would want to store in the cookie?

The code for the cookie source is what we copied from Google's QUIC implementation 1.5 years ago or so. I changed the cookie source to use a nonce size of 32 byte, as you suggested, and also removed the HKDF. I'm not sure though why're suggesting using a per-message key, I thought using the same key will be ok as long as the nonce is not reused. Can you please explain?
I also made the DefaultCookieSource public. When using non-blocking mode, an app will have to provide its own implementation for the CookieSource. The DefaultCookieSource should work fine in easy use cases, such as running a single server (in a multi-server deployment you'll need some shared cookie source anyway, and probably also implement some key rotation mechanism).

ekr · 2017-11-09T12:54:07Z

The issue with the nonce here is that AES-GCM fails catastrophically if you have nonce reuse. If you use a random nonce, you get a non-trivial probability of reuse with enough connections (the 50% mark is at 2^{48} but the risk is unacceptably high well below that). Unfortunately, just making the nonce bigger doesn't help because AES-GCM hashes a >96 bit nonce down to 96 bits.

If you want to use GCM, you can guarantee a unique key/nonce pair by generating a longer nonce and then using HKDF to turn the master key into a key/nonce. Because the output is longer, the chance of collision is reduced.

marten-seemann · 2017-11-14T15:58:18Z

I just pushed a fixed. We're now creating a new key (which is HKDF derived using the nonce as a salt) for every nonce.

ekr · 2017-11-27T22:34:21Z

cookie_source.go

 }

-const tokenKeySize = 16
-const tokenNonceSize = 16
+var _ CookieSource = &DefaultCookieSource{}


I am probably not enough of a Golang wizard, but why is this neded.

Strictly speaking this is not needed. It makes the compiler check that DefaultCookieSource actually implements the CookieSource interface. Since it's an assignment to _, it will be removed during compilation.

ekr · 2017-11-27T22:41:13Z

cookie_source.go

+	if err != nil {
+		return nil, err
+	}
+	return aead.Seal(nonce, nonce, data, nil), nil


I don't think this is quite what you want. Rather, you want to do:

r := make([]byte, 32) rand.Read(r) key = hkdf(secret, R, []byte("mint cookie key")) // key length nonce = hkdf(secret, R, []byte("mint cookie nonce")) // 12 bytes

And then you can use nonce the way you have it here.

Or, if you prefer you can just read the key and the nonce as successive values from the hkdf.

How is that supposed to work? When decoding the cookie, I don't know r any more, and I can't create the AEAD to open the cookie.

The cookie is r || aead.Seal(blah...)

Right now you are just using nonce == r, so the difference I am proposing is you hkdf r to make the nonce.

ekr · 2017-11-27T22:42:47Z

cookie_source.go

+	if err != nil {
+		return nil, err
+	}
+	return cipher.NewGCMWithNonceSize(c, cookieNonceSize)


You want NewGCM()

ekr · 2017-11-27T22:43:26Z

cookie_source_test.go

+		_, err := cs.DecodeToken([]byte("too short"))
+		assertError(t, err, "it should reject too short tokens")
+		_, err = cs.DecodeToken(append(bytes.Repeat([]byte{0}, cookieNonceSize), []byte("invalid token")...))
+		assertError(t, err, "it should reject invalid tokens")


It would also be good to have one with a bogus nonce, e.g., by stomping the first byte.

marten-seemann · 2017-11-30T21:02:15Z

@ekr, I implemented the changes for the CookieSource as you suggested. Please have another look.

ekr · 2017-11-30T21:42:15Z

@marten-seemann I think you forgot to push

marten-seemann · 2017-11-30T21:44:01Z

I don't think so. I rebased and amended the commit.

ekr · 2017-11-30T21:45:14Z

Oh, ok. Will take a look

…

On Thu, Nov 30, 2017 at 1:44 PM, Marten Seemann ***@***.***> wrote: I don't think so. I rebased and amended the commit. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#141 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/ABD1oWBf6g5W4Xakvb7Mqyicm_25VN12ks5s7yGhgaJpZM4QVzSU> .

ekr · 2017-11-30T21:55:02Z

cookie_source.go

+	aeadNonce := make([]byte, 12)
+	if _, err := io.ReadFull(h, aeadNonce); err != nil {
+		return nil, nil, err
+	}


This looks fine to me. Assuming you didn't change anything else, I think this is good to Go. @bifurcation ??

I didn't change anything else. This should be ready to merge now.

bifurcation · 2017-12-04T18:05:44Z

.circleci/config.yml

@@ -0,0 +1,10 @@
+version: 2


Unless this change is necessary for this functionality, please put it in a separate PR.

This was the first commit of this PR (03b32d6). I openend #147, containing just this one commit.

marten-seemann · 2017-12-06T03:50:42Z

@bifurcation: Is there anything else you need from me to merge this PR?

bifurcation

Just to confirm my understanding, we basically have a three-layer cookie here:

Application content (from CookieHandler)
Mint framing (cookie{})
Protection (CookieSource)

Assuming I'm understanding the structure here, this looks fine to me. Couple of nits and one file name change in the comments, then it's ready to merge.

bifurcation · 2017-12-06T13:59:08Z

alert.go

@@ -82,6 +83,7 @@ var alertText = map[Alert]string{
 	AlertUnknownPSKIdentity:          "unknown PSK identity",
 	AlertNoApplicationProtocol:       "no application protocol",
 	AlertNoRenegotiation:             "no renegotiation",
+	AlertStatelessRetry:              "stateless retry",


bifurcation · 2017-12-06T14:05:50Z

cookie_source.go

@@ -0,0 +1,86 @@
+package mint


For consistency with the other files, this should be cookie-source.go (reserving underscores for _test).

bifurcation · 2017-12-06T14:12:39Z

conn.go

-	// The default cookie handler uses 32 random bytes as a cookie.
-	CookieHandler     CookieHandler
+	// A CookieHandler can be used to set and validate a cookie.
+	// The cookie returned by the CookieHandler will be part of the cookie sent on the wire, and endoced using the CookieSource.


Nit: "encoded"

bifurcation · 2017-12-06T14:14:17Z

conn.go

+	// It should make sure that the Cookie cannot be read and tampered with by the client.
+	// If non-blocking mode is used, and cookies are required, this field has to be set.
+	// In blocking mode, a default cookie source is used, if this is unused.
+	CookieSource      CookieSource


Nit: CookieSource doesn't seem like the right name for something whose job is to protect / unprotect cookie values. CookieProtection or something like that?

marten-seemann · 2017-12-06T15:30:05Z

@bifurcation: I rebased this PR on top of the current master, fixed the typo, and renamed the CookieSource to CookieProtector.

bifurcation · 2017-12-06T21:50:10Z

@marten-seemann Thanks! Merging and moving on to #145 ...

marten-seemann force-pushed the stateless-reset branch from f51e228 to e29ba77 Compare November 8, 2017 03:44

ekr requested changes Nov 8, 2017

View reviewed changes

marten-seemann force-pushed the stateless-reset branch 3 times, most recently from a1ccfc5 to 533628f Compare November 9, 2017 02:27

marten-seemann force-pushed the stateless-reset branch from cdef62e to c3810f4 Compare November 9, 2017 07:11

marten-seemann force-pushed the stateless-reset branch from c3810f4 to 6fe79a8 Compare November 14, 2017 15:54

marten-seemann mentioned this pull request Nov 25, 2017

do not automatically advance state in non-blocking mode #145

Merged

ekr requested changes Nov 27, 2017

View reviewed changes

marten-seemann force-pushed the stateless-reset branch from 6fe79a8 to 8d11ddc Compare November 30, 2017 20:36

ekr reviewed Nov 30, 2017

View reviewed changes

marten-seemann mentioned this pull request Dec 1, 2017

use the mint cookie protector to generate cookies quic-go/quic-go#966

Closed

bifurcation reviewed Dec 4, 2017

View reviewed changes

This was referenced Dec 5, 2017

use the mint default cookie protector to generate cookies quic-go/quic-go#978

Merged

application-defined session tickets #148

Open

ekr approved these changes Dec 6, 2017

View reviewed changes

bifurcation requested changes Dec 6, 2017

View reviewed changes

marten-seemann added 4 commits December 6, 2017 22:21

implement stateless resets

1e8da32

also save the negotiated cipher suite in the cookie

cf5746e

increase nonce size and derive a separate key for every nonce

570ac8d

return AlertStatelessRetry after sending a HelloRetryRequest

3da3cc7

rename the CookieSource to CookieProtector

f9e1617

marten-seemann force-pushed the stateless-reset branch from 8d11ddc to f9e1617 Compare December 6, 2017 15:27

bifurcation approved these changes Dec 6, 2017

View reviewed changes

bifurcation merged commit 3b976e1 into bifurcation:master Dec 6, 2017

marten-seemann deleted the stateless-reset branch December 6, 2017 23:32

marten-seemann mentioned this pull request Dec 7, 2017

fix the crypto setup so that it works with the recent mint changes quic-go/quic-go#995

Merged

implement stateless resets #141

implement stateless resets #141

Conversation

marten-seemann commented Nov 8, 2017

ekr commented Nov 8, 2017

ekr left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

marten-seemann commented Nov 9, 2017

ekr commented Nov 9, 2017

marten-seemann commented Nov 14, 2017

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

marten-seemann commented Nov 30, 2017

ekr commented Nov 30, 2017

marten-seemann commented Nov 30, 2017

ekr commented Nov 30, 2017 via email

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

marten-seemann commented Dec 6, 2017

bifurcation left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

marten-seemann commented Dec 6, 2017 • edited Loading

bifurcation commented Dec 6, 2017

marten-seemann commented Dec 6, 2017 •

edited

Loading