Re: [TLS] Consensus for AEAD IV

[Ilari Liusvaara <[e-mail]>]

On Sun, Apr 26, 2015 at 02:00:48PM -0400, Michael StJohns wrote:
> On 4/25/2015 11:47 PM, Yoav Nir wrote:
> >
> >>On Apr 26, 2015, at 6:21 AM, Michael StJohns <[e-mail]
> >><mailto:[e-mail]>> wrote:
> 
> You're actually going to make it impossible to use TLS1.3 with generic
> hardware modules.

Define "generic hardware module".
 
What key derivation operations it supports? Both secret->secret and
secret->public (and yes, the latter _will_ be needed).

> >Now you pass the encryption function the handle, the data to be encrypted
> >(and protected) and a message counter. The function (hardware or software)
> >converts the counter into a nonce by XOR-ing with the quantity, and
> >proceeds from there. There is no reason not to treat the 96-bit quantity
> >as anything but secret.
> 
> There is no reason to treat the 96 bit quantity as secret and no one else
> does.

Oh, except SSH. The session nonce is 96 bits and secret.

(To lesser extent, IPSEC, there the session nonce is 32 bits and secret).

> TLS should use generic interfaces rather than inventing stuff that can't.

Well, given that one needs to derive public data out of secret keys, that
sure can also derive per-connection IVs out of secrets.


-Ilari