Re: [TLS] rfc7366: is encrypt-then-mac implemented?

[Peter Gutmann <[e-mail]>]

Manuel Pégourié-Gonnard <[e-mail]> writes:

>Are you refering the "normal" (MtE) case or the EtM case here? 

The EtM case.  In the MtE case what gets MAC'd is the plaintext, i.e. only
TLSCompressed.fragment.  In the EtM case what gets MAC'd is the ciphertext
including padding and other stuff, so GenericBlockCipher.fragment.

>This is supported by the fact that both (what get's MAC'd and what goes in
>the wire) are written as TLSCiphertext.length in the RFC.

The correct notation to use is quite confusing, intuitively you can say "the
length used in the MAC calculation is the length of the data that gets MAC'd",
but specifying it in notation isn't so easy, it's the length of the padded
encrypted TLSCompressed value as well as the length of the IV if TLS 1.1 or
newer is used.  If there's some clear way of saying that that, say, at least
three different people can agree on I'll use it.

>Again, I have no preference on which interpretation is chosen, as long as
>there remains only one arguably valid way to interpret the text.

Sure.

>   MAC(MAC_write_key, seq_num +
>       TLSCipherText.type +
>       TLSCipherText.version +
>       length of ENC(content + padding + padding_length) +
>       IV +
>       ENC(content + padding + padding_length));
>
>    where the length is encoded as two bytes in the usual way.

That's still not quite right though because it excludes the length of the IV
when it's present in TLS 1.1+ (see above).  The intent of using
TLSCipherText.length was to accommodate the different protocol-version-
dependent options.

What about defining it the other way round, instead of saying "the length used
is this and that and sometimes something else", say "the length value used for
the MAC computation is the length as encoded on the wire minus
SecurityParameters.mac_length, since the MAC value is not included in the MAC
computation"?  So perhaps:

  Note that the value of the 'uint16 length' field in the TLSCiphertext record
  differs from the length value used in the MAC calculation, since the
  TLSCiphertext record contains both the ciphtertext and the MAC, while the
  MAC calculation is performed only over the ciphertext.  So the length value
  encoded in the TLSCiphertext record is 'length' while the length value used
  in the MAC calculation is 'length - SecurityParameters.mac_length'.

Peter.