Re: [TLS] Encryption of TLS 1.3 content type

Eric Rescorla <ekr@rtfm.com> Mon, 28 July 2014 21:27 UTC

MIME-Version: 1.0
In-Reply-To: <49AFE121-7421-4FCE-B3D8-46B75581F5B2@iki.fi>
References: <DD255E31-FA87-40CE-AF13-0F43A7DD54CF@cisco.com> <CACsn0cnt-ry182AjOyTTZGteifs7VyRPYHaj-xDCBOf0D53w9A@mail.gmail.com> <CAAF6GDfK7awipoMT_PPyKnTe-fF1=KY1Be8kUMSYrXN0Wzb=tg@mail.gmail.com> <1406537753.2413.12.camel@dhcp-2-127.brq.redhat.com> <CAAF6GDcKqymNMnVa50Q7kSTgHrWcM1-qMNGyxU-NcjXMnCD3gQ@mail.gmail.com> <1406560456.7750.20.camel@dhcp-2-127.brq.redhat.com> <CAAF6GDcnmyc5n0XfeunrV9GvQdhO1cePdXKwYNWRpnS8bQ4ZHA@mail.gmail.com> <49AFE121-7421-4FCE-B3D8-46B75581F5B2@iki.fi>
From: Eric Rescorla <ekr@rtfm.com>
Date: Mon, 28 Jul 2014 14:26:38 -0700
Message-ID: <CABcZeBNt5WpEdX1zPR2SeBZDBeXmLXDnc4eCBpW7a5J448b-4A@mail.gmail.com>
To: Juho Vähä-Herttua <juhovh@iki.fi>
Content-Type: multipart/alternative; boundary="e89a8f64702174edac04ff479604"
Archived-At: http://mailarchive.ietf.org/arch/msg/tls/JV7G4Fao3j1kYnZDL3G7uQjXMDQ
Cc: "tls@ietf.org" <tls@ietf.org>
Subject: Re: [TLS] Encryption of TLS 1.3 content type
Precedence: list

On Mon, Jul 28, 2014 at 2:23 PM, Juho Vähä-Herttua <juhovh@iki.fi> wrote:

>
> > On 29.7.2014, at 0.15, Colm MacCárthaigh <colm@allcosts.net> wrote:
> >
> > On Mon, Jul 28, 2014 at 8:14 AM, Nikos Mavrogiannopoulos
> > <nmav@redhat.com> wrote:
> >> On the contrary, all _new_ ciphers are stream (GCM, CCM)
> >
> > Now you've got me scratching my head, because both GCM and CCM are
> > authentication modes for block ciphers, not stream.
>
> They are both authenticated counter modes for block ciphers, which means
> they behave like stream ciphers. Even though the output from the cipher
> comes in blocks, all redundant bytes in the end can be dropped, unlike in
> CBC mode.
>

FWIW, TLS has this idiosyncratic defn. of the term "stream cipher" that
matches
RC4 but not AEAD ciphers or even CTR mode... Hence comments about how
we are deprecating stream ciphers but not GCM.

-Ekr


> Therefore 2 byte alert encrypted with GCM or CCM is still 2 bytes plus the
> authentication tag. I believe this is what Nikos meant.
>
>
> Juho
>
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls
>

Re: [TLS] Encryption of TLS 1.3 content type Yoav Nir
Re: [TLS] Encryption of TLS 1.3 content type Fabrice Gautier
Re: [TLS] Encryption of TLS 1.3 content type Eric Rescorla
[TLS] Encryption of TLS 1.3 content type Joseph Salowey (jsalowey)
Re: [TLS] Encryption of TLS 1.3 content type Watson Ladd
Re: [TLS] Encryption of TLS 1.3 content type Colm MacCárthaigh
Re: [TLS] Encryption of TLS 1.3 content type Juho Vähä-Herttua
Re: [TLS] Encryption of TLS 1.3 content type Peter Gutmann
Re: [TLS] Encryption of TLS 1.3 content type Yoav Nir
Re: [TLS] Encryption of TLS 1.3 content type Nikos Mavrogiannopoulos
Re: [TLS] Encryption of TLS 1.3 content type Yoav Nir
Re: [TLS] Encryption of TLS 1.3 content type Daniel Kahn Gillmor
Re: [TLS] Encryption of TLS 1.3 content type Martin Rex
Re: [TLS] Encryption of TLS 1.3 content type Colm MacCárthaigh
Re: [TLS] Encryption of TLS 1.3 content type Nikos Mavrogiannopoulos
Re: [TLS] Encryption of TLS 1.3 content type Daniel Kahn Gillmor
Re: [TLS] Encryption of TLS 1.3 content type Nikos Mavrogiannopoulos
Re: [TLS] Encryption of TLS 1.3 content type Viktor Dukhovni
Re: [TLS] Encryption of TLS 1.3 content type Brian Sniffen
Re: [TLS] Encryption of TLS 1.3 content type Stephen Farrell
Re: [TLS] Encryption of TLS 1.3 content type Michael StJohns
Re: [TLS] Encryption of TLS 1.3 content type Yoav Nir
Re: [TLS] Encryption of TLS 1.3 content type Colm MacCárthaigh
Re: [TLS] Encryption of TLS 1.3 content type Eric Rescorla
Re: [TLS] Encryption of TLS 1.3 content type Andy Lutomirski
Re: [TLS] Encryption of TLS 1.3 content type Peter Gutmann
Re: [TLS] Encryption of TLS 1.3 content type Alfredo Pironti
Re: [TLS] Encryption of TLS 1.3 content type Martin Rex
Re: [TLS] Encryption of TLS 1.3 content type Alfredo Pironti