Re: [TLS] TLS1.3

[[e-mail] (Martin Rex)]

Scott Schmit wrote:
> On Mon, Feb 11, 2013 at 04:33:27PM +0100, Martin Rex wrote:
> > Martin Rex wrote:
> > > > >When the encryption scheme that is used is bijective, then it
> > > > >will not matter (to the confidentiality of the encryption)
> > > > >whether AtE or EtA is used, as long as authentication covers the
> > > > >exact same information in both cases, i.e.  *ALL* of it, padding
> > > > >included.
> > > > 
> > > > However you do need to to MAC the IV.
> > > 
> > > Correct. 
> > 
> > Re-thinking it,  I believe it would be OK to _not_ cover the CBC-IV in
> > the AtE, while you *MUST* cover the IV in the EtA case.
> 
> Look at the CBC decrypt operation again. If I can modify the IV, I can
> modify the first block of your plaintext.  So much for authentication...

I'm sorry, but I fail to see what your comment refers to.

The CBC-IV is either part of the ciphertext or part of the keying material,
but never part of the plaintext.

For Authenticate-then-Encrypt (AtE), it is unnecesary to cover the IV
by the Authentication (it is also not currently done in TLS), and
independent of whether the CBC-IV is part of the keying material
as in SSLv3/TLSv1.0 or part of the ciphertext as in TLSv1.1+.

For Encrypt-then-Authenticate, you MUST cover the CBC-IV by the
authentication when it is part of the ciphertext (TLSv1.1+), and
you MAY cover the CBC-IV (or not) when it is part of the keying
material (SSLv3/TLSv1.0)

-Martin