Re: [Cfrg] Streaming AEAD

Hi Peter,

On 02/18/2014 04:13 AM, Peter Gutmann wrote:
> "Manger, James" <James.H.Manger@team.telstra.com> writes:
>
>> What is needed is a way to use an AEAD algorithm to secure a message in
>> chunks. Streaming-AEAD would allow a recipient to know they have received an
>> authentic prefix of a message. It would allow crypto APIs to support
>> streaming modes while never returning unauthentic plaintext.
> I think the means of doing this is going to be protocol-specific, since it
> depends on the PDU format being used.

I think that's right.   It still makes sense to consider what should be 
going on above the AEAD layer, in a generic sense.

> For things like SSL/TLS and SSH the
> problem is already solved since data amounts are quantised to the protocol
> data packet size,

I hope that's right.   I am not sure that SSL/TLS implementers would be 
comfortable if they could never use the decryptUpdate function though.

> for store-and-forward protocols like PGP and S/MIME you'd
> need to add a mechanism for it in a PGP/SMIME-specific manner, but then you'd
> also need to figure out how to communicate it to the other side... and then
> you're back to relying on ad-hoc mechanisms.
>
> When I had to do this years ago I used something like:
>
> len1 || data1 || h1 = HMAC( len1 || data1 ),
> len2 || data2 || h2 = HMAC( h1 || len2 || data2 ),
> len3 || data3 || h3 = HMAC( h2 || len3 || data3 ),
> ...
>
> A length of 0 indicated end-of-contents.

Interesting, is there a writeup?

thanks,

David

>
> Peter.
> _______________________________________________
> Cfrg mailing list
> Cfrg@irtf.org
> http://www.irtf.org/mailman/listinfo/cfrg
>