Re: [TLS] ChaCha and IVs

[Bodo Moeller <[e-mail]>]

Nico Williams <[e-mail]>:

> On Wed, Mar 5, 2014 at 6:35 PM, Bodo Moeller <[e-mail]> wrote:
>


> > I suppose if this becomes an actual concern for evaluation, you could
> create
> > a more easily evaluable module that accepts explicit IVs but checks that
> > these increase monotonically between invocations.  (Accepting *explicit*
> IVs
> > doesn't mean you have to accept *arbitrary* IVs.)
>
> This.
>
> However in the DTLS case there's no way to make the sequence numbers
> be monotonic.  What the module could do is keep its own IV sequence
> number window and reject the use of sequence numbers that are too old
> or reused...
>
> ...but note that in the decrypt case it may still be useful to know
> that a message is a replay and yet get the authentication tag state
> and plaintext outputs.  The GSS-API's GSS_Unwrap() function supports
> this.
>

Right -- sorry, when I wrote the above, I only meant a check when
*en*crypting. *De*cryption is normally expected to have to handle
potentially arbitrary explicit IVs, anyway: for example, if encryption uses
random IVs, decryption will just have to accept these -- you wouldn't be
generating random IVs in the decryption module too :-).

Bodo