Re: [TLS] some more questions and comments on draft-ietf-tls-ctr-00.txt

Hi Nikos, sorry about the delay in responding.  My comments inline:

> 1. What is the size of IV generated after the ciphersuite is generated? 
> 128 bits? In that case why not generate only 48 bits if the rest of the
> bits are not used?

Good catch -- I'll clean up this text.

> 2. What is the purpose of having the blk_ctr and the seq_num used in the 
> counter and reinitialized for every record packet? What do they protect
> from?
> 
> 3. What is the rationale behind constructing a counter block in the
> given way? Why not use the full 128 bit IV? 

Agreed, there's nothing wrong with using the full 128-bit IV.  The current
design mimics counter block generation as described in 3686.  This design
also has the minor advantage that no additions are required in order to 
generate the counter block. 

> 4. terminology: sometimes different than rfc2246. Say the abreviations 
> PT block and CT block are never used in rfc2246. Also "nonce" could be
> "random bytes" to match rfc2246.

Is the current description unclear?  2246 doesn't need to use the same
shorthand for plain text and cipher text since ciphering transformations
are only described in prose.  I don't think nonce is used anywhere, or am
I missing something?

> 5. At par 3.1.1. It says "A given counter block MUST never be
>  used more than once with the same key.". But this is not up
>  to the implementation to choose, thus must instead of MUST
>  may be more appropriate.

The goal is to make it clear about the security requirements of
implementing CTR mode, and hence the corresponding requirement
on sequence number usage.  I'm happy to discuss further if
this is an issue.

> 6. Same paragraph: It gives a brief description of CTR, but I think
> it can be confusing to somebody who doesn't know CTR. It says
> "Each PT block is XORed with a block of the key stream to generate the
>    ciphertext, CT.  The AES encryption of each counter block results in
>    128 bits of key stream."
> but nowhere before it was mentioned that CTR mode is supposed to 
> generate a key stream.

I'll clarify in the introduction section.

Thanks,
nagendra

_______________________________________________
TLS mailing list
TLS@lists.ietf.org
https://www1.ietf.org/mailman/listinfo/tls