Re: [TLS] Consensus call on Implicit IV for AEAD

[Dave Garrett <[e-mail]>]

On Friday, April 03, 2015 11:17:04 pm Brian Smith wrote:
> Conversely, there is a clear record of my objection to the
> zero-padding mechanism on the mailing list, and there seems to be at
> least some mild support for my suggested alternative of deriving the
> initial nonce from the keyblock.

Yeah, correct me if I missed it, but there didn't seem to be any real
opposition to adding randomization to the nonce. There was suggestion
of using XOR rather than ADD to mix random & sequence, but either could
work.

> Finally, Ilari Liusvaara noted in the previous thread on the topic
> that SSH already does exactly what I'm proposing, or very similar.
> And, he also noted that IPSEC partially randomizes the nonce, as does
> TLS 1.2. It seems like zero padding would be a regression from what
> TLS 1.2 does, in terms of security. I find that concerning.

I would think it shouldn't be too hard to get agreement that following
this pattern is something worth continuing. At worst, it won't hurt.


Dave