Re: [TLS] Comments on

[Adam Langley <[e-mail]>]

On Fri, Feb 14, 2014 at 3:49 PM, Niels Möller <[e-mail]> wrote:
> The proper way is to process the file incrementally (with bounded RAM),
> write the result to a temporary file on disk (preferably hidden, if
> supported by the OS). At the end of data, check authentication, and
> either rename the file and advertise it, or delete it and return a
> failure exit code.

I think that's a fine API to expose if you can limit it to operations
like that. However, I fear requirements creep will will set in as data
needs to be further processed and one ends up evincing a "streaming"
API that has the unauthenticated plaintext problems that I worry
about.

For example, in my favourite, recreational language of the moment
(Go), the convention for layering transforms like decryption is to do
it in a streaming fashion via a minimal interface that provides a
read() like, virtual function. Using a temp file in a library would be
considered poor form, although it does solve the truncation problem.

I admit that I'm hypothesising with little evidence which implies that
the argument can be dismissed with little effort.

Although, if you were to implement just an API like that then you
could require that update be called exactly once, since it wouldn't be
public API anyway, and that would solve your AD length problems.

> But in the case that you really want proper authentication of the
> *complete* file before you start processing it, I think an AEAD chunking
> format is additional complexity with no benefit over plain AEAD, since
> plain AEAD provides exactly the type of autentication needed.

I think the benefit is that one doesn't have to worry about possibly
exposing an unsafe, streaming API. Everything can be composed from a
one-shot, AEAD function and we don't have to worry about littering
header files with more comments describing the superficially correct,
but unsafe, ways that the functions shouldn't be used.

But just because it's not my personal preferences doesn't mean that
it's unreasonable.


Cheers

AGL