Re: [TLS] ChaCha and IVs

[Brian Smith <[e-mail]>]

On Tue, Mar 4, 2014 at 10:15 AM, Stephen Kent <[e-mail]> wrote:

> Security evaluation for a crypto alg does not include a protocol like ESP
> or
> (D)TLS; if focuses only on the alg implementation. Thus a TLS "guarantee"
> of uniqueness is not relevant. Anyone who has had a product evaluated will
> tell you that the goal is always to minimize the amount of code that is
> subject
> to review. If one were to use a TLS (or ESP) sequence number for an IV,
> all of
> the protocol code would be part of the evaluation, and that would make the
> evaluation prolonged and very costly.


ChaCha20-Poly1304 can't be validated anyway, even if it used explicit IVs,
because it isn't an algorithm that has been approved by any agency that
requires validation.

One can have the crypto component generate the ciphertext and the counter
IV in a way that is guaranteed to be a monotonically increasing sequence.
This code would be the code that would be validated. Then, have your TLS
implementation take that counter IV that was output from the crypto
component and verify that it matches the current record number, and fail if
there is a mismatch.

Certification programs exist, in theory, to ensure that we do good, safe
things. In this case, we have a bit of bureaucracy that is getting in the
way of doing something that is clearly good and safe. The best solution to
that problem is to fix the bureaucracy. If one cannot fix the bureaucracy
then one can simply avoid implementing ChaCha20-Poly1304 and implement
AES-GCM or other cipher suites instead.

Cheers,
Brian
-- 
Mozilla Networking/Crypto/Security (Necko/NSS/PSM)