Re: [TLS] Clarifications and questions: TLS1.3 - Static RSA and AEAD

[Michael StJohns <[e-mail]>]

On 5/27/2014 9:59 AM, Blumenthal, Uri - 0558 - MITLL wrote:
> IVs:  contrary to what some people tend to believe, IV does not have to be
> random (or even unpredictable). Being unique is sufficient in many cases,
> including AEAD.

Hi Uri -

I seem to remember for some modes that the IV has to unpredictable - I 
believe that CBC was one. (But may be mitigated by integrity checks to 
defeat chosen plain text attacks?  I don't have time to search for a 
cite).  You are correct that uniqueness is the only requirement for 
AEAD, but mostly AEAD IVs are constructed from a [random nonce][per 
message value][block counter 0] concatenation - the random nonce 
enforces the uniquity.

Mike