Re: [TLS] Consensus call on Implicit IV for AEAD

In support of Tom, I would note that Namprempre et al.'s EUROCRYPT paper 'Reconsidering Generic Composition' is relevant: https://eprint.iacr.org/2014/206.pdf

They define a nonce-based AEAD (nAE) scheme as a function (inputs and outputs are bitstrings):

    (n, ad, p) \rarrow (c, t)

and requires that the resulting scheme be IND-CCA$ (?) iff

     $\forall m, \nexist m', m.ad = m'.ad \wedge m.n = m'.n \wedge m.p \nea m'.p$

I would strongly suggest that the TLS 1.3 recommendation impose this requirement for any AEAD suites specified in future.

--

Or, more simply: IVs must be indistinguishable from random bytes. Nonces must simply be unique.

Assuming that the 'IV' input to the TLS AEAD functions is predictable, it isn't an IV. It's a nonce. Please call it that, and disallow ivAE schemes.

—
Sent using alpine: an Alternatively Licensed Program for Internet News and Email

On Sun, Apr 5, 2015 at 6:10 PM, Tom Ritter <tom@ritter.vg> wrote:

> On 3 April 2015 at 15:34, Joseph Salowey <joe@salowey.net> wrote:
>> In the interim meeting we had consensus to use an implicit IV for AEAD.  The
>> proposal was to use the record sequence number and pad with zeros as
>> described in pull request 155
>> (https://github.com/tlswg/tls13-spec/pull/155/files).  This was also
>> discussed in the IETF-92 meeting in Dallas along with options to change the
>> offset.  The consensus was to stay with the original proposal.  We are
>> posting to the mailing list to confirm this consensus. If you have comments,
>> please reply by April 17, 2015.
> I apologize if I'm mistaken or this has been raised previously, but I
> feel compelled to speak up and not assume it has.
> The record sequence number is predictable. It's not in the clear on
> the wire, but it begins at 0 and increments with every record.
> (Right?)
> This will result in a predictable IV for the AEAD mode.  We have two
> AEAD modes today:
>  - GCM - IV must be unique, being predictable doesn't matter (Right?)
>  - poly1305 - IV/Nonce must be unique, being predictable doesn't matter (Right?)
> But we also don't know what AEAD modes we will add in the future.  I'm
> far from being 'up' on the CAESER competition, but I skimmed the first
> ~10 entries, and one, CMCC  is based on CBC mode. It seems like a
> predictable IV = BEAST.  Am I right in thinking we will be
> pigeonholing ourselves into only allowing AEAD modes that do _not_
> require an unpredictable IV?
> -tom
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls