Re: Read-out on offline connection ID discussion

[Christian Huitema <[e-mail]>]

> On Jan 24, 2018, at 10:45 PM, Mikkel Fahnøe Jørgensen <[e-mail]> wrote:
> 
>> On 25 January 2018 at 00.16.55, Eric Rescorla ([e-mail]) wrote:
>> I don’t understand this requirement for the CID to be 16 bytes in order to be encrypted.
>> If you have a unique key you can encrypt 0, truncate and xor with the CID.
>> If you don’t have a unique key, you can encrypt a unique counter value and do the same, or derive a unique key.
>> 
>> I don't believe what you are describing works correctly, but I'm not sure I understand your proposal. Can you please flesh out precisely what you have in mind? In particular, who is "you", who has the key, etc.?
> 
> I’m merely stating that if you want to encrypt with AES and you do not care about authentication, then AES works fine with shorter inputs than 16 bytes. You may still have to provide an initialisation vector so the +n still holds. The last block of AES-GCM is not a full block and works as i described - see sect. 2.3 and figure 1 in link to GCM paper. If the last block is the only block, you encrypt less than 16 bytes without any magic.
> 
AES GCM is a stream cipher. It is OK in AEAD mode, but using that without authentication opens the way to all the known attacks against stream ciphers. If we don't have room for authentication, then ECB mode seems much preferable.

--Christian Huitema