Re: [kitten] Input on Paul's concerns about aes-cbc

[Tom Yu <[e-mail]>]

Sam Hartman <[e-mail]> writes:

> Folks, I'd really appreciate input from those who responded to the AES
> CBC consensus call.
>
> 1) Do you need any additional information to evaluate Paul's message?

I would like more information on whethere there is likely to be any
way forward to make applications using the Windows encryption APIs
more capable of supporting padded CBC modes.  (This might include
improving the documentation of these APIs.)  I will need to review
some more MSDN documentation before I can ask the right questions
though.

I'm also fully willing to believe that encryption APIs providing
padded CBC modes are too difficult for application developers to
consistently write correct code for.

> 2) Has Paul's message caused you to revise your opinions in any way?

I think at this point we're best off standardizing something that
satisfies as many Suite B criteria as we can get consensus on, while
meeting the constraints of Windows applications that might not be
aware of a need to do padding.  To me, this means some variant of the
AES CTS mode that we described in RFC 3962.

I think the Suite B criteria that we might be able to satisfy include:

* Encrypt-then-MAC

* Full-length MAC using appropriate SHA-2 hashes

* Maybe explicit IV (though I prefer to continue using confounders for
  reasons I've already mentioned)

I think we can consider counter modes, but we should figure out how to
manage the nonce reuse/collision risks if we're going to do that.