Re: [kitten] considering abandoning CTS mode (Re: I-D Action:draft-ietf-kitten-aes-cts-hmac-sha2-01.txt)

[Nico Williams <[e-mail]>]

On Wed, Aug 14, 2013 at 5:55 PM, Michiko Short <[e-mail]> wrote:
> I am curious why we aren't just using the same AES-CTS as in the current RFC?

The initially proposed AES-CTS-HMAC-SHA-2 enctype didn't confound,
though it did have a random block prefix.  This is an optimization
over confounding: we've mostly convinced ourselves that it merely only
reduces the number of AES block operations required, not the security
of the whole.  But this meant that we can have ciphertexts that are
shorter than one block, which CTS cannot handle.

We then set about using the non-confounded nonce as a source of
"ciphertext" to steal from.  The result was more complex than the CTS
we use today, and shares with CTS the general lack of support in
existing APIs (e.g., PKCS#11).  Tom Yu and others expressed concern
about this and a preference for plain old CBC with nonces.  Ever since
we've been wondering if this would be a problem for Microsoft,
specifically for DCE and SSPI applications.

Nico
--