Re: [TLS] ChaCha and IVs

[Dr Stephen Henson <[e-mail]>]

On 04/03/2014 17:57, Nikos Mavrogiannopoulos wrote:
> On Tue, 2014-03-04 at 11:53 -0500, Stephen Kent wrote:
> 
>> An algorithm implementation submitted for FIPS evaluation 
>> must be independently evaluable 
> 
>>From the wording I don't understand how this is relevant to your point
> for nonces. Could you elaborate?
> 

In the case of AES-GCM there are some requirements for how the IV is generated
for FIPS (and FIPS 140-2) compliance.

It has been a while since I looked at this in detail but from memory it
effectively meant the explicit part of the IV had to be generated by the module
itself on encrypt (various schemes were permissible). An application couldn't
specify an arbitrary value which would seem to preclude the use of the sequence
number directly.

So on encrypt you'd typically call the module to generate the explicit part of
the IV and then use that generated value in the protocol (for TLS copy it to the
explicit IV part of the record).

Steve.
-- 
Dr Stephen N. Henson.
Core developer of the   OpenSSL project: http://www.openssl.org/
Freelance consultant see: http://www.drh-consultancy.co.uk/
Email: [e-mail], PGP key: via homepage.