Re: [TLS] Consensus call on Implicit IV for AEAD

Eric Rescorla <ekr@rtfm.com> Mon, 06 April 2015 02:13 UTC

Return-Path: <ekr@rtfm.com>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E490A1A6EFB for <tls@ietfa.amsl.com>; Sun, 5 Apr 2015 19:13:47 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.977
X-Spam-Level:
X-Spam-Status: No, score=-1.977 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6ukTyvzItDi9 for <tls@ietfa.amsl.com>; Sun, 5 Apr 2015 19:13:46 -0700 (PDT)
Received: from mail-wi0-f172.google.com (mail-wi0-f172.google.com [209.85.212.172]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 92D6B1A6EE1 for <tls@ietf.org>; Sun, 5 Apr 2015 19:13:45 -0700 (PDT)
Received: by wiun10 with SMTP id n10so21758111wiu.1 for <tls@ietf.org>; Sun, 05 Apr 2015 19:13:44 -0700 (PDT)
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc:content-type; bh=wfjWzQCCCwr76eC4f7JHjFAcQ0LDLOh09NQJmnAf7q8=; b=TmkpRuBOIlLAur6LsUi8B/+aQ4BZWlxt68Kz2LTLUH8+0ZfNUIOrHdBc2Sn/+1BcMb ZnKy91069IEW+hn73crh7aEmlVMVTDhPLqPKGU9TfWggpqGmGGjVJ8MLQT9cWWFvBdJP yTlAGsgZk6jBNlNBsl+GaVhWPCFtENJrBfmGmNqq6MDh7waYsslriiGds5E390u5dJl4 MOqn0k+BwYc3LBKyvN06g0BEpOBUBcj5txexpZ1jrQf4l1JSIGKLi+f5qkCNAnIMdvCN 8ZT7QEbwF/eyDfLHuNlxJZfGxzx55P947zKQgXIJWLcQXKZtJ2CtGVT0JQ++YKVjMu6Q K2dw==
X-Gm-Message-State: ALoCoQkaiRbKIIJoALP/oaBY1NLV0hcTfqrkHd3/pnq9b+3DzS+rOY/alLp82ltqTd5EqSfpNpNm
X-Received: by 10.180.91.11 with SMTP id ca11mr55391441wib.10.1428286424335; Sun, 05 Apr 2015 19:13:44 -0700 (PDT)
MIME-Version: 1.0
Received: by 10.27.205.87 with HTTP; Sun, 5 Apr 2015 19:13:04 -0700 (PDT)
In-Reply-To: <CA+cU71=AZjGgisDyOyAeRsgh6PZDbiH2YTv3grn-d-4quunmNg@mail.gmail.com>
References: <CAOgPGoCW-znnh5VFobCFjZafxEOcwsaHZ_eByTwpCpmqfgX=6Q@mail.gmail.com> <CA+cU71=AZjGgisDyOyAeRsgh6PZDbiH2YTv3grn-d-4quunmNg@mail.gmail.com>
From: Eric Rescorla <ekr@rtfm.com>
Date: Sun, 5 Apr 2015 19:13:04 -0700
Message-ID: <CABcZeBNsRXrkRf2iyPrXDYd4j-oAYLo+KzTCy7bbROjZVWs2xw@mail.gmail.com>
To: Tom Ritter <tom@ritter.vg>
Content-Type: multipart/alternative; boundary=f46d043c7e76f5db30051304d86e
Archived-At: <http://mailarchive.ietf.org/arch/msg/tls/Ajf9gDG0ZQ70UGrcBahH1ueymJU>
Cc: "tls@ietf.org" <tls@ietf.org>
Subject: Re: [TLS] Consensus call on Implicit IV for AEAD
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 06 Apr 2015 02:13:48 -0000

On Sun, Apr 5, 2015 at 6:10 PM, Tom Ritter <tom@ritter.vg> wrote:

> On 3 April 2015 at 15:34, Joseph Salowey <joe@salowey.net> wrote:
> > In the interim meeting we had consensus to use an implicit IV for AEAD.
> The
> > proposal was to use the record sequence number and pad with zeros as
> > described in pull request 155
> > (https://github.com/tlswg/tls13-spec/pull/155/files).  This was also
> > discussed in the IETF-92 meeting in Dallas along with options to change
> the
> > offset.  The consensus was to stay with the original proposal.  We are
> > posting to the mailing list to confirm this consensus. If you have
> comments,
> > please reply by April 17, 2015.
>
>
> I apologize if I'm mistaken or this has been raised previously, but I
> feel compelled to speak up and not assume it has.
>
> The record sequence number is predictable. It's not in the clear on
> the wire, but it begins at 0 and increments with every record.
> (Right?)
>
> This will result in a predictable IV for the AEAD mode.  We have two
> AEAD modes today:
>  - GCM - IV must be unique, being predictable doesn't matter (Right?)
>  - poly1305 - IV/Nonce must be unique, being predictable doesn't matter
> (Right?)
>
> But we also don't know what AEAD modes we will add in the future.  I'm
> far from being 'up' on the CAESER competition, but I skimmed the first
> ~10 entries, and one, CMCC  is based on CBC mode. It seems like a
> predictable IV = BEAST.  Am I right in thinking we will be
> pigeonholing ourselves into only allowing AEAD modes that do _not_
> require an unpredictable IV?


I think we are restricting ourselves to AEAD modes that allow a predictable
nonce (this is the 5116 terminology). However, it's worth noting two points
about this:

1. All of the proposed constructions use related nonces in the sense that
if you knew the nonce for a single record, you could derive the nonce
for all records sent in that direction.

2. A predictable nonce does not mean that you have a predictable IV
for an underlying cipher. For instance, as AGL noted in a previous
e-mail [0], it is possible to construct an unpredictable IV from a
predictable
nonce.

-Ekr

[0] https://www.ietf.org/mail-archive/web/tls/current/msg15533.html

>
> -tom
>
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls
>