QS06: separate composite-KEM construction risk from negotiation downgrade risk - #17
QS06: separate composite-KEM construction risk from negotiation downgrade risk#17m-khan-97 wants to merge 2 commits into
Conversation
Addresses OWASP#12. The entry treated hybrid misuse as one undifferentiated risk and opened with an uncited claim that hybrid is "widely misimplemented". Standardised named groups inherit a reviewed construction; the transition-window risk is dominated by negotiation fallback and downgrade, and by demonstrated implementation timing leaks. Also updates two stale anchors: draft-ietf-tls-hybrid-design was published as RFC 9954 (July 2026), and draft-kwiatkowski-tls-ecdhe-mlkem is now draft-ietf-tls-ecdhe-mlkem, which defines X25519MLKEM768.
|
Splitting QS06 into construction / negotiation-and-deployment / implementation resolves the One refinement on the negotiation layer, to keep its mechanism as precise as the rest of the entry. Common The more damaging vector is the one Example #1 called out: the client's own Suggest reframing Scenario #1 around induced fallback / permissive negotiation rather than in-handshake |
TLS 1.3 transcript authentication means in-handshake stripping aborts rather than completes, and RFC 9954 hybrids are single named groups with no half-share to strip. The practical downgrade is the client's own fallback logic retrying classical-only after an induced failure - a completed, internally valid handshake with no tampering on the wire. Description, Common Example OWASP#2, Scenario OWASP#1 and the fallback-testing prevention step reframed accordingly. RFC 8446 Section 4.1.3 added to references.
|
You are right, and thank you for the precision - this is exactly the standard the rewrite was aiming for and fell short of in one place. The Finished MAC over the transcript means edited groups produce divergence and an abort, not a completed classical handshake, and since the RFC 9954 hybrids are single concatenated named groups there is no half-share to strip in the first place. The stripping framing re-introduced the imprecision #12 was about, as you say. Pushed a commit reframing it around induced fallback: the attacker only needs the first hybrid attempt to fail, and the client's own retry logic completes a fresh, internally valid classical handshake - which is also what makes "no operational trace" accurate, since the only thing on the wire is a clean classical session. Changes: the negotiation paragraph in the description, Common Example #2, Scenario #1, the fallback-testing prevention step, and RFC 8446 Section 4.1.3 added to the references. Preference-list ordering and the middlebox-disable path (Scenario #3) stay as the no-attacker-needed routes to the same end state. If the wording anywhere still under- or over-claims, I would genuinely welcome the exact phrasing you had in mind. |
|
This reads accurately now; the negotiation paragraph, Example #2, Scenario #1, and the fallback-testing step all frame it correctly: the Finished MAC aborts tampered handshakes, and the real exposure is the endpoint's own fallback / preference-list / middlebox behavior. From my side it's good to merge. One optional micro-precision, only because you asked for exact wording: reference #3 annotates §4.1.3 as "downgrade protection and transcript authentication," but §4.1.3 is specifically the version-downgrade sentinel (ServerHello.random). The transcript authentication that makes edited groups abort is the Finished MAC over the transcript hash (§4.4.4 + the key schedule), which is a separate mechanism. Your body text already keeps them distinct; only the reference note lumps them. If you want it to mirror the body: RFC 8446 - TLS 1.3: §4.1.3 version-downgrade protection (the ServerHello.random sentinel); handshake integrity against group/parameter tampering comes from the Finished MAC over the transcript (§4.4.4). Together these confine the practical downgrade path to endpoint fallback behavior rather than in-handshake tampering. The entry is accurate as written; this just tightens the citation to match the body. Thanks! |
2 participants
Addresses the conflation raised in #12 by @rot169, and updates two references that
have moved since the v0.1 entry was written.
The problem
The entry currently treats "hybrid misuse" as one undifferentiated risk, and opens
with the uncited claim that hybrid is "widely misimplemented". As #12 points out,
that does not match what practitioners observe: mainstream libraries implement
hybrid as standardised named groups, and OpenSSL 3.5 offers X25519MLKEM768 as a
default keyshare. Getting the construction wrong requires deliberately breaking
rule zero and hand-rolling a combiner.
The change
The rewrite separates three layers that need different mitigations, and drops the
uncited claim:
draft-ietf-tls-ecdhe-mlkem.Per #12's suggestion, the negotiation layer is given the most weight: it is the one
that silently produces classical traffic in an estate recorded as migrated. A
downgraded session is a harvested session, so this entry now explicitly points
upstream to QS01.
Reference updates
Two anchors are stale, independent of the rewrite:
draft-ietf-tls-hybrid-designwas published as RFC 9954 (Informational,July 2026). The entry cited it as a draft. QS05 cites the same draft and will
need the same update - happy to do that in a separate PR rather than reach into
another entry here.
draft-kwiatkowski-tls-ecdhe-mlkemwas adopted by the TLS WG and is nowdraft-ietf-tls-ecdhe-mlkem(-05, May 2026), IESG-approved and awaiting RFCpublication. It defines the X25519MLKEM768 group at the centre of QS06 phrasing #12's point
and was not previously cited at all.
Added: KyberSlash (IACR TCHES), CVE-2024-37880, OpenSSL 3.5 release notes as
primary evidence for the default-groups claim. All references verified against
primary sources on 2026-07-27; the header comment records this.
Notes for reviewers
entries stay uniform: the description is split into paragraphs rather than one
block, because a three-layer model is hard to follow otherwise; and there is a
third attack scenario covering the middlebox-to-disabled-hybrid path, which is
the failure practitioners actually hit and which no other entry covers.
layers. Something like "Insecure Migration: Downgrade and Hybrid Misuse" would
track the content better, but I have left the title and filename unchanged since
renaming affects the README table and any external links. Happy to do it if you
want it.
Standards and Regulatory Mappingsection is kept with its TODO bannerintact and updated in place. Its fate seems to belong to Proposal: Extend the OWASP Quantum Security Top 10 Entry Template to improve Consistency, Actionability and Verifiability #15 rather than here.