Re: [Cfrg] Proposed Informational Note: Security Guidelines for Cryptographic Algorithms in the W3C Web Cryptography API

Manuel Pégourié-Gonnard <mpg@elzevir.fr> Fri, 21 November 2014 07:55 UTC

Message-ID: <546EF006.1060205@elzevir.fr>
Date: Fri, 21 Nov 2014 08:55:50 +0100
From: Manuel Pégourié-Gonnard <mpg@elzevir.fr>
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:31.0) Gecko/20100101 Thunderbird/31.2.0
MIME-Version: 1.0
To: David Gil <dgil@yahoo-inc.com>, "Scott Fluhrer (sfluhrer)" <sfluhrer@cisco.com>, "jberliner@caa.columbia.edu" <jberliner@caa.columbia.edu>, Watson Ladd <watsonbladd@gmail.com>
References: <546E0AE5.3040601@w3.org> <CACsn0cn+KX9J1NSUFhKV32iWL4KLHEPOKcXea3cD20QK2YeeaA@mail.gmail.com> <CAP4fkhhBs1QHj5OFoukJdBt2L=EL0PEZ8yefC8S-JRFM=4WX=Q@mail.gmail.com> <A113ACFD9DF8B04F96395BDEACB340420BE7E5EA@xmb-rcd-x04.cisco.com> <546E248E.8020305@elzevir.fr> <1416505822.31934.YahooMailNeo@web310003.mail.ne1.yahoo.com>
In-Reply-To: <1416505822.31934.YahooMailNeo@web310003.mail.ne1.yahoo.com>
OpenPGP: id=98EED379; url=https://elzevir.fr/gpg/mpg.asc
Content-Type: text/plain; charset="windows-1252"
Content-Transfer-Encoding: 7bit
Archived-At: http://mailarchive.ietf.org/arch/msg/cfrg/8KjSN-rjU09n6fmbIBHTxiV3y_A
Cc: "cfrg@irtf.org" <cfrg@irtf.org>
Subject: Re: [Cfrg] Proposed Informational Note: Security Guidelines for Cryptographic Algorithms in the W3C Web Cryptography API
Precedence: list

On 20/11/2014 18:50, David Gil wrote:
>> "AES-CFB is not CCA secure. It is CPA-secure if the IV is random, but it is not
>> enough for the IV be be a nonce [rogaway11evaluation]."
> 
> Could we please just use the terminology that every paper on crypto uses?
> 
> Standard jargon: IVs are always uniform (computationally hard 
> pseudo)random strings. Nonces are strings that are used only once.
> 
Sure. How would you word the above sentence?

> As Watson noted, an IV of sufficient length is with high probability
> a nonce; best is to set len(IV) = 2*s, where s is the target security
> strength.
> 
Yes, and as I noted, there are existing cases where this length condition is not
satisfied.

Manuel.

[Cfrg] Proposed Informational Note: Security Guid… Harry Halpin
Re: [Cfrg] Proposed Informational Note: Security … Salz, Rich
Re: [Cfrg] Proposed Informational Note: Security … Watson Ladd
Re: [Cfrg] Proposed Informational Note: Security … Jonathan Berliner
Re: [Cfrg] Proposed Informational Note: Security … Paul Hoffman
Re: [Cfrg] Proposed Informational Note: Security … Scott Fluhrer (sfluhrer)
Re: [Cfrg] Proposed Informational Note: Security … Manuel Pégourié-Gonnard
Re: [Cfrg] Proposed Informational Note: Security … Yaron Sheffer
Re: [Cfrg] Proposed Informational Note: Security … David Gil
Re: [Cfrg] Proposed Informational Note: Security … Watson Ladd
Re: [Cfrg] Proposed Informational Note: Security … Harry Halpin
Re: [Cfrg] Proposed Informational Note: Security … Yaron Sheffer
Re: [Cfrg] Proposed Informational Note: Security … Harry Halpin
Re: [Cfrg] Proposed Informational Note: Security … Harry Halpin
Re: [Cfrg] Proposed Informational Note: Security … Dan Brown
Re: [Cfrg] Proposed Informational Note: Security … Yaron Sheffer
Re: [Cfrg] Proposed Informational Note: Security … Dan Harkins
Re: [Cfrg] Proposed Informational Note: Security … Manuel Pégourié-Gonnard