21.1 Lucky 13
In 2013, Nadhem AlFardan and Kenneth Paterson, two researchers from the Information Security Group at Royal Holloway, University of London, published a new attack that can recover plaintexts by exploiting timing differences in the decryption process of then-current TLS versions 1.1 and 1.2 [4].
Lucky 13 – we will explain the reason for the attack’s unusual name in a moment – targets the TLS Record protocol. More specifically, it exploits an implementation detail stemming from a recommendation in the TLS 1.1 and 1.2 standards.
If, during decryption, Alice encounters a TLS record with malformed padding, she still has to perform MAC verification to prevent trivial timing attacks (we will talk more about timing attacks and, in general, side-channel attacks in Chapter 22, Attacks on TLS Implementations). The question is, what data should Alice use for that calculation?
The TLS 1.1 and 1.2 standards recommend checking the MAC as if it had a zero...