Re: [TLS] Pull Request: Removing the AEAD explicit IV

[Yoav Nir <[e-mail]>]

> On Mar 17, 2015, at 8:21 PM, Adam Langley <[e-mail]> wrote:
> 
> On Tue, Mar 17, 2015 at 11:06 AM, Michael StJohns
> <[e-mail]> wrote:
>> That works for the currently defined pure AEAD modes (CCM/GCM at least,
>> haven't looked at chacha).   Will that work in all cases for constructed
>> AEAD modes?  (e.g. where we build an AEAD mode out of an encryption mode and
>> an integrity mode and derive the E and I keys from a single key internal to
>> the constructed mode - say  AES-CBC with CMAC for example).  Short answer is
>> probably not.
> 
> I believe that it will, although I welcome counterexamples.
> 
> The AEAD interface requires only an nonce (i.e. unique, but not
> unpredictable) and, under this proposal, that's all that TLS will
> provide.
> 
> CBC modes require an IV (i.e. unpredictable). If you wished to make an
> AES-CBC-HMAC-SHA256 AEAD, for example, then you would do something
> like this:
> 
> Define the key length to be twice as large as the AES key and split it
> internally into a CBC key and an IV key. For each record, generate the
> IV by AES(key = IV_key, block = nonce) then encrypt the plaintext
> using CBC with that IV and the CBC key. (And you might need extra key
> bytes for the HMAC too, but that's beside the point here.) Basically
> you can generate the IVs using AES-CTR as a PRNG.

Right. Or you could do like in https://tools.ietf.org/html/draft-mcgrew-aead-aes-cbc-hmac-sha2-05 , generate the IV randomly and locally and call it part of the ciphertext (see appendix A). The AEAD interface has no requirement that the ciphertext have the same length as the plaintext. In fact CBC requires padding, so the ciphertext is larger anyway.

I do like your way better, but it requires a larger state on both client and server. 

I’m also wondering if we can mass convert all the existing CBC ciphersuites for TLS 1.3, so that ciphersuite 0x00,0x0a could be TLS_RSA_WITH_3DES_EDE_CBC_SHA in TLS 1.2, but transform into one of these AEAD constructions for TLS 1.3 without having to allocate new identifiers.

Yoav