Re: [TLS] Comments on

[Nikos Mavrogiannopoulos <[e-mail]>]

On Fri, 2014-02-14 at 14:49 -0500, Adam Langley wrote:

> > By streaming, I don't advocate you do the decryption in a pipe line;
> > that's clearly a dangerous habit. Usecase is more like on one machine
> > running
> >   src-machine$ tar -cf - foo-dir | aead-encrypt | send
> This use of streaming is fine by my criteria, assuming that
> "aead-encrypt" is chunking the input into different blocks and
> applying the AEAD to each block. This is perfectly fine with a
> one-shot(*), AEAD API at the core.

I'd pretty much agree with the chunked approach, but I now realize that
it is more hard to get it right than the streaming one. In the chunked
approach one would need to implement sequence numbers (could be implicit
as additional data) and a termination block. So both approaches have
quite some disadvantages. The streaming approach allows for misuse of
the API which may cancel the benefits of AEAD, and the chunked approach
requires the developer to create a safe protocol over AEAD.

If the idea is for AEAD to be used by an average developer, it seems we
need even a higher abstraction than that; even for such a simple
use-cases.

regards,
Nikos