Re: [TLS] tales from the TLS interim: TLS 1.3 MTI algorithms

[Eric Rescorla <[e-mail]>]

On Wed, Mar 18, 2015 at 3:55 PM, Yoav Nir <[e-mail]> wrote:

>
> On Mar 18, 2015, at 11:05 PM, Eric Rescorla <[e-mail]> wrote:
>
>
> On Wed, Mar 18, 2015 at 2:11 AM, Rob Stradling <[e-mail]>
> wrote:
>
>> On 18/03/15 07:38, Yoav Nir wrote:
>>
>>> On Mar 18, 2015, at 12:11 AM, Sean Turner <[e-mail]> wrote:
>>>>
>>> <snip>
>>
>>> Please note that CFRG is already done with ChaCha20-Poly1305. The
>>> document is approved and in the RFC Editor’s queue.
>>>
>>> The ball is not in this working group’s court. It’s time to decide about
>>> draft-mavrogiannopoulos-chacha-tls.
>>
>>
> I await the chair's action on this.
>
> In the meantime, I see that we have developed a conflict between this
> draft and
>
> https://github.com/tlswg/tls13-spec/pull/155
>
> Because this PR prescribes a specific mechanism for generating the nonce
> (left-padding the record sequence number) which conflicts with the one for
> this draft. Assuming that people feel that the approach we arrived at in
> the interim is appropriate, we will probably want to adjust this draft
> prior
> to acceptance.
>
>
> The draft is suitable for TLS 1.2 as well, so I’m not sure it needs to
> comply with the nonce generation procedure of TLS 1.3.  It’s better for it
> to be like other AEADs such as AES-GCM, and then get adapted to TLS 1.3
> just like AES-GCM.
>

Well, it's already not like GCM because the GCM draft uses a partially
explicit nonce (64 bits) that is carried separately in the record whereas
this draft uses the record sequence number in that location. What I am
proposing is that instead of using an IV generated from the master secret
as the upper 32 bits of the nonce, ChaCha20 should just use 0s. This
would make it like TLS 1.3.

Alternately, I suppose you could make it like GCM, but it seems like the
WG is moving towards saving those bits, so that seems odd.

-Ekr