Re: [TLS] removal of nonces [was: What would make TLS cryptographically better for TLS 1.3]

[Nico Williams <[e-mail]>]

On Sat, Nov 02, 2013 at 08:26:34AM +0100, Nikos Mavrogiannopoulos wrote:
> On 11/01/2013 12:09 AM, Nico Williams wrote:
> >  - Many fewer nonce bytes and random IVs where possible.  Nonce payloads
> >    should be sent when needed, if needed.  For example, to derive a
> >    session key from an DHE shared secret one does not really need
> >    nonces.
> 
> Not really. Nonces are needed even in DHE ciphersuites. The nonces in
> TLS make sure that the signatures from both parties are fresh and only
> valid for this session (i.e., cannot be taken and re-used in another
> session). See how PKINIT Kerberos has issues when used with smart cards,
> just because it saved a round-trip by not sending a server nonce.

If your DH key is fresh then you don't need a nonce: the shared secret
will have a minimum of entropy close to that which you put into
selecting the DH private key, even if your peer reuses their DH key.

If you reuse DH keys then you need a coutner/nonce; the size of the
counter/nonce relates to the number of times you plan on reusing the DH
key.

>              [...], what would that buy? [...]

Nonces and explicit (even confounded) random IVs -especially the latter-
provide high subliminal channel bandwidth.  Smaller/fewer nonces and
explicit random IVs -> less subliminal channel bandwidth.  Capping the
number of subliminal channel bits per-connection is even more
interesting.

Nico
--