[Cfrg] request for comments on "Generation of Deterministic Initialization Vectors (IVs) and Nonces"

Hi Peter,

your note seems like a good introduction for this topic.  I wrote up a  
draft describing how deterministic IVs should be generated, and  
reviewing how they are used in different protocols:

http://tools.ietf.org/html//draft-mcgrew-iv-gen-00

Comments welcome.  You have a lot of experience with the  
implementation of robust crypto software, so if you have additions or  
improvements to Section 5 that would be great.

Side note: I was somewhat surprised that I was able to write a 24 page  
document on a topic as narrow as IV generation, and your reminder to  
everyone of how important a topic it is makes me feel a bit better :-)

David

On Jul 18, 2011, at 10:02 PM, Peter Gutmann wrote:

> =?iso-8859-1?Q?J=E9r=E9mie_Crenne?= <jeremie.crenne@univ-ubs.fr>  
> writes:
>
>> What is the feeling of the community about the recent potential AES- 
>> GCM
>> weakness due to weak keys ?
>
> GCM's problem isn't the weak keys in AES-GCM, it's that it's a KSG  
> rather than
> a standard block cipher.  It's RC4 all over again, and we're going  
> to see the
> same problems with GCM that we've already seen with RC4.  There have  
> been
> several already, and the only reason why we haven't seen more is  
> that GCM
> isn't used that much (that is, it's used in a small number of widely- 
> deployed
> applications, but hasn't become the universal algorithm of choice  
> that RC4
> was.  Once, or if, it does, we'll see exactly the same problems that  
> plagued
> RC4 throughout its effective lifetime).
>
> Peter.
> _______________________________________________
> Cfrg mailing list
> Cfrg@irtf.org
> http://www.irtf.org/mailman/listinfo/cfrg