Re: [TLS] Pull Request: Removing the AEAD explicit IV

[Eric Rescorla <[e-mail]>]

On Thu, Mar 19, 2015 at 12:53 PM, Brian Smith <[e-mail]> wrote:

> Eric Rescorla <[e-mail]> wrote:
> > PR: https://github.com/tlswg/tls13-spec/pull/155
> > Target merge date: 3/21
>
> My concern about this is the same one already raised on the CFRG mailing
> list:
>    http://www.ietf.org/mail-archive/web/cfrg/current/msg04867.html
> in response to:
>    http://www.ietf.org/mail-archive/web/cfrg/current/msg04820.html
>
> In particular, massively parallel attacks on many keys at once seem
> like the most promising way to break AES-128. It seems bad to have
> popular endpoints encrypting the same plaintext block (e.g. "GET /
> HTTP/1.1\r\n") with the same nonce (1) with different keys. That seems
> like exactly the recipe for making such attacks succeed.
>

Are other people concerned about this issue? I seem to remember this
being discussed in the interim and AGL being opposed to this change.



> It seems like it would be better, instead, to require that the initial
> nonces to be calculated from the keyblock established during key
> agreement,


Is there any reason why these should be derived from the keyblock
as opposed to from purely public information such as the random
values?



> and then have them incremented as counters (with
> wraparound) in the same fashion as being proposed.


Can you explain why you think they need to change? I note that TLS 1.2
currently does not behave in this fashion.

-Ekr