Re: [hybi] It's time to ship

[Adam Barth <[e-mail]>]

On Thu, Jan 13, 2011 at 1:09 AM, Takeshi Yoshino <[e-mail]> wrote:
> On Thu, Jan 13, 2011 at 06:15, Adam Barth <[e-mail]> wrote:
>> On Wed, Jan 12, 2011 at 12:28 PM, Bjoern Hoehrmann <[e-mail]>
>> wrote:
>> > * Adam Barth wrote:
>> >>http://www.ietf.org/id/draft-abarth-thewebsocketprotocol-01.txt
>> >
>> > This says:
>> >
>> >  The masked-data is the clear-text frame encrypted under AES-128-CTR
>> >  (see [TODO: Cite AES-128-CTR]) using the masking-key as the key and
>> >  the initial counter value equal to the masking-nonce followed by 28
>> >  zero octets.
>> >
>> >  For example, octet i of the masked-data is computed from octet i of
>> >  the clear-text frame as follows:
>> >
>> >    initial-counter = masking-nonce << 96
>> >    masked-octet-i = clear-text-octet-i XOR AES_k(initial-counter + i)
>> >
>> >  where AES_k is AES keyed with the masking-key.
>> >
>> > Could you give a reference for AES-128-CTR and explain the example?
>>
>> Here's an example RFC that uses AES-128-CTR
>>
>> http://www.ietf.org/rfc/rfc4344.txt
>>
>> I believe it's technically defined by combining
>> http://csrc.nist.gov/publications/fips/fips197/fips-197.pdf and
>> http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf, the
>> later of which contains test vectors.  (Careful readers will notice
>> that my example is wrong.)
>>
>
> So, this part can be rewritten like this, I thought. do you think it's
> correct?
> ----
> ...[snip]
>    the initial counter value equal to the masking-nonce followed by 12
> ...[snip]
>   initial-counter = masking-nonce << 96
>   for i = 0 to size-of-clear-text - 1
>     j = i MOD 16
>     if j == 0
>       frame-key = AES_k(initial-counter + i / 16)
>     masked-octet-i = clear-text-octet-i XOR octet-j-of-frame-key
> ----
> and, since masking-key is 20 octet length, it looks like we must
> truncated/padded key to fit AES key size?

Something like that.  Luckily we have crypto experts to help us get it
exactly right.

Adam