Re: [TLS] Pull Request: Removing the AEAD explicit IV

[Brian Smith <[e-mail]>]

Eric Rescorla <[e-mail]> wrote:
> PR: https://github.com/tlswg/tls13-spec/pull/155
> Target merge date: 3/21

My concern about this is the same one already raised on the CFRG mailing list:
   http://www.ietf.org/mail-archive/web/cfrg/current/msg04867.html
in response to:
   http://www.ietf.org/mail-archive/web/cfrg/current/msg04820.html

In particular, massively parallel attacks on many keys at once seem
like the most promising way to break AES-128. It seems bad to have
popular endpoints encrypting the same plaintext block (e.g. "GET /
HTTP/1.1\r\n") with the same nonce (1) with different keys. That seems
like exactly the recipe for making such attacks succeed.

It seems like it would be better, instead, to require that the initial
nonces to be calculated from the keyblock established during key
agreement, and then have them incremented as counters (with
wraparound) in the same fashion as being proposed. This, combined with
the fact that the key agreement will always be using ephemeral keys,
should prevent any such massively-parallel attack from working.

Note that this is a concern more for AES-128 than it is for ChaCha20
because ChaCha20 mitigates the issue by using a 256-bit key.

Other than disagreeing with how the initial nonce is determined, I
agree that the implicit counter approach is better than the explicit
per-record nonce approach.

I think this issue should be addressed before this change is made.

Cheers,
Brian