I am looking at RFC5246 and it seems that AES-CBC/SHA cipher suites cannot be implemented in a cut-through mode.

Let's suppose that received record spans two segments. As i understood HMAC calculation can be started only after the last byte (pad_length) of second record is decrypted, that requires to buffer both segments comprising a record.

Am I missing something ?


Am I missing something ?

Well, the first obvious question to ask, even before "can I?" is "should I?".

It would appear, from a security standpoint, doing TLS in a cut-through mode would have security issues, and so it's not clear that it should be attempted, even if you could.

Suppose you did; you implemented a way to receive a partial TLS record, and send the partial decrypted plaintext record to the receiver.

Then, what an attacker could do is send a TLS record claiming to be a 16k byte encrypted record, and then send segments containing the first 15k of ciphertext of his choosing; if won't be able to come up with a matching HMAC; he might decide not to send that at all.

Your implementation will decrypt the 15k of ciphertext and forward it along. It'll then either receive an HMAC that doesn't match, or time out; it doesn't matter, as the receiver has received his 15k of bogus plaintext.

And, if you say "the attacker has no control over what his ciphertext will decrypt to, and so it's not that critical of an attack", well, that's wrong. By pasting in ciphertexts from previous records, and/or flipping well chosen bits (which will garble one plaintext block, but flip the corresponding bits of another plaintext block), the attacker has quite a bit of flexibility.

This isn't a concern with TLS as it was designed, as the entire decrypted record is never forwarded to the application until the HMAC validates; you're breaking that assumption.

  • $\begingroup$ Thank for your response, my question is just about right understanding of the RFC requirement I am looking for a way to accelerate processing with minimum buffering requirements in a right way and ignoring HMAC check does not looks so $\endgroup$ – Elena Gurevich Nov 22 '17 at 10:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.