Re: [Cfrg] New Version Notification for draft-mcgrew-aead-aes-cbc-hmac-sha2-03.txt

["Manger, James" <[e-mail]>]

> Title: Authenticated Encryption with AES-CBC and HMAC-SHA
> Htmlized:       http://tools.ietf.org/html/draft-mcgrew-aead-aes-cbc-hmac-sha2-03


Section 2.1. "Encryption" adds:

  "The key MUST MUST be generated in a way that is uniformly random or pseudorandom"

This must be a doubly important requirement ;-)


Section 2.2 "Decryption" step 5 talks about removing the padding (1 byte of 0x01 to 16 bytes of 0x10). It requires an implementation to partially check the padding, but not completely. For instance, if the last byte is 0x22 then the operation fails and data is zeroized. Whereas if the last 2 bytes are 0x22 0x02 then decryption will probably succeed, removing those 2 bytes as padding. A better implementation is probably to infer the padding length from the last 4 bits. That can never fail.


Section 2.4 AEAD_AES_128_CBC_HMAC_SHA_256 has the wrong key length. The key length is mentioned twice. Both should be 32 octets. One was wrong in the previous draft, but now both are wrong! I guess a fixed was applied at the wrong point.


Typo: missing ) in section 2.4
   makes use of a random value (the IV described in Appendix A.

Typo: section 2.4
WRONG   ...(AES) [FIPS197] block cipher defined in CBC mode.
RIGHT   ...(AES) [FIPS197] block cipher in CBC mode.


Otherwise it looks great.

--
James Manger