Re: [TLS] Consensus call on Implicit IV for AEAD

[Tom Ritter <[e-mail]>]

On 3 April 2015 at 15:34, Joseph Salowey <[e-mail]> wrote:
> In the interim meeting we had consensus to use an implicit IV for AEAD.  The
> proposal was to use the record sequence number and pad with zeros as
> described in pull request 155
> (https://github.com/tlswg/tls13-spec/pull/155/files).  This was also
> discussed in the IETF-92 meeting in Dallas along with options to change the
> offset.  The consensus was to stay with the original proposal.  We are
> posting to the mailing list to confirm this consensus. If you have comments,
> please reply by April 17, 2015.


I apologize if I'm mistaken or this has been raised previously, but I
feel compelled to speak up and not assume it has.

The record sequence number is predictable. It's not in the clear on
the wire, but it begins at 0 and increments with every record.
(Right?)

This will result in a predictable IV for the AEAD mode.  We have two
AEAD modes today:
 - GCM - IV must be unique, being predictable doesn't matter (Right?)
 - poly1305 - IV/Nonce must be unique, being predictable doesn't matter (Right?)

But we also don't know what AEAD modes we will add in the future.  I'm
far from being 'up' on the CAESER competition, but I skimmed the first
~10 entries, and one, CMCC  is based on CBC mode. It seems like a
predictable IV = BEAST.  Am I right in thinking we will be
pigeonholing ourselves into only allowing AEAD modes that do _not_
require an unpredictable IV?

-tom