Re: [Cfrg] Streaming AEAD

[Peter Gutmann <[e-mail]>]

"Manger, James" <[e-mail]> writes:

>What is needed is a way to use an AEAD algorithm to secure a message in
>chunks. Streaming-AEAD would allow a recipient to know they have received an
>authentic prefix of a message. It would allow crypto APIs to support
>streaming modes while never returning unauthentic plaintext.

I think the means of doing this is going to be protocol-specific, since it
depends on the PDU format being used.  For things like SSL/TLS and SSH the
problem is already solved since data amounts are quantised to the protocol
data packet size, for store-and-forward protocols like PGP and S/MIME you'd
need to add a mechanism for it in a PGP/SMIME-specific manner, but then you'd
also need to figure out how to communicate it to the other side... and then
you're back to relying on ad-hoc mechanisms.

When I had to do this years ago I used something like:

len1 || data1 || h1 = HMAC( len1 || data1 ), 
len2 || data2 || h2 = HMAC( h1 || len2 || data2 ),
len3 || data3 || h3 = HMAC( h2 || len3 || data3 ),
...

A length of 0 indicated end-of-contents.

Peter.