Re: [TLS] Pull Request: Removing the AEAD explicit IV

[Eric Rescorla <[e-mail]>]

On Sun, Mar 22, 2015 at 7:10 PM, Brian Smith <[e-mail]> wrote:

> Eric Rescorla <[e-mail]> wrote:
> > Adam, Brian, what would you think of XOR rather than addition?
> >
> > E.g., generate a per-connection value V and then do:
> >
> > Nonce = Seq XOR V?
>
> Would the sequence number be logically the same size as the nonce (128
> bits or 256 bits), or would the spec will forbid sending 2^64 or more
> records under the same key?


What I had in mind was the latter.

-Ekr


> Either solution prevents the need to worry
> about the record number overflowing, but my answer depends on which
> approach is chosen.
>
> The advantage of XOR is that it is easy to implement correctly,
> because mutli-machine-word XOR is easier to implement than
> multi-machine-word unsigned integer addition with wraparound during
> overflow. However, XOR is also easier to implement *wrongly* without
> anybody noticing, by only doing the XOR for a single machine word
> (e.g. only the lower 32 bits on a 32-bit machine). It's not so
> practical to do a conformance test that sends/receives 2^32+1 or
> 2^64+1 records..
>
> It seems harder to implement addition wrongly without anybody noticing
> because all of the overflow cases should be triggered during interop
> testing and thus any bugs found and corrected. So, without knowing the
> answer to my question above, I prefer addition.
>
> Cheers,
> Brian
>