[kitten] confounding >> random IV?

[Nico Williams <[e-mail]>]

If you have an RNG that has a backdoor such that anyone who possesses
the key to it can recover the next output given any one output (of
some given size, perhaps), then random IVs and nonces leak RNG state
if they are taken directly from the RNG.  Confounding eliminates this
problem, at least for RFC3961 crypto.

Maybe we should keep confounding.

Of course, this notion is rather contrived.  No one in their right
minds would run an RNG like that...

Also, confounding cannot protect against other backdoored PRNG
attacks, just those where the attacker gets a lot of value from
observing direct PRNG outputs.

So maybe confounding adds no value; it definitely subtracts
performance.  But we should at the very least note this in the new
enctypes' security considerations.

Also, we should consider carefully whether we really want to ditch confounding.

Nico
--