Re: [TLS] Consensus call on Implicit IV for AEAD

On Sun, Apr 5, 2015 at 6:10 PM, Tom Ritter <tom@ritter.vg> wrote:

> On 3 April 2015 at 15:34, Joseph Salowey <joe@salowey.net> wrote:
> > In the interim meeting we had consensus to use an implicit IV for AEAD.
> The
> > proposal was to use the record sequence number and pad with zeros as
> > described in pull request 155
> > (https://github.com/tlswg/tls13-spec/pull/155/files).  This was also
> > discussed in the IETF-92 meeting in Dallas along with options to change
> the
> > offset.  The consensus was to stay with the original proposal.  We are
> > posting to the mailing list to confirm this consensus. If you have
> comments,
> > please reply by April 17, 2015.
>
>
> I apologize if I'm mistaken or this has been raised previously, but I
> feel compelled to speak up and not assume it has.
>
> The record sequence number is predictable. It's not in the clear on
> the wire, but it begins at 0 and increments with every record.
> (Right?)
>
> This will result in a predictable IV for the AEAD mode.  We have two
> AEAD modes today:
>  - GCM - IV must be unique, being predictable doesn't matter (Right?)
>  - poly1305 - IV/Nonce must be unique, being predictable doesn't matter
> (Right?)
>
> But we also don't know what AEAD modes we will add in the future.  I'm
> far from being 'up' on the CAESER competition, but I skimmed the first
> ~10 entries, and one, CMCC  is based on CBC mode. It seems like a
> predictable IV = BEAST.  Am I right in thinking we will be
> pigeonholing ourselves into only allowing AEAD modes that do _not_
> require an unpredictable IV?

I think we are restricting ourselves to AEAD modes that allow a predictable
nonce (this is the 5116 terminology). However, it's worth noting two points
about this:

1. All of the proposed constructions use related nonces in the sense that
if you knew the nonce for a single record, you could derive the nonce
for all records sent in that direction.

2. A predictable nonce does not mean that you have a predictable IV
for an underlying cipher. For instance, as AGL noted in a previous
e-mail [0], it is possible to construct an unpredictable IV from a
predictable
nonce.

-Ekr

[0] https://www.ietf.org/mail-archive/web/tls/current/msg15533.html

>
> -tom
>
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls
>