[Cfrg] IVs in the "authenticated encryption" draft

[David McGrew <[e-mail]>]

Hello,

if you've read the draft, I'd be interested to hear your thoughts on  
the use of IVs in that document.  Currently, the IV is an *output* of  
the encryption process, rather than an input to it.  This property  
puts IV generation into the crypto process, which simplifies the  
interface for most users and eliminates the risk of security problems  
due to inappropriate IV generation by the user.   However, this  
property adds some complexity; in order to support the use of  
deterministic IVs when a single key is used by multiple encryptors,  
it was necessary to add an "IV" contribution field.

I very much like the idea of having an interface that is harder to  
misuse, but I'm now wondering if that goal is "one too many" for the  
current draft.  Perhaps it would be better to allow the IVs to be  
inputs, as is more conventional, which would allow this draft to get  
finished more quickly, and then to consider a user-proof interface in  
some separate future work, if that would be useful.  I've heard  
comments on both sides of this issue, and I'd like to gauge the  
general feeling of the group, so I'd value your opinion.

thanks,

David


_______________________________________________
Cfrg mailing list
[e-mail]
https://www1.ietf.org/mailman/listinfo/cfrg