Re: [TLS] About TLS 1.2 AEAD ciphers definition

[Juho Vähä-Herttua <[e-mail]>]

On 27.5.2010, at 19.04, Adam Langley wrote:
> On Thu, May 27, 2010 at 11:29 AM, Juho Vähä-Herttua <[e-mail]> wrote:
>> So I'm curious to know how is AEAD actually handled and how to find out the
>> TLSCompressed.length when constructing additional_data for AEAD-Decrypt? I'm
>> sure there are more experienced people here who can tell me the answer.
>> Thank you in advance.
> 
> I believe that none of the currently defined AEAD ciphers introduce
> padding, so it's pretty easy for the moment.

The only currently defined AEAD ciphers seem to be AES_128_GCM and AES_256_GCM defined by RFC 5288. I'm a bit surprised that AES encryption doesn't introduce padding though, it might be just me misunderstanding the GCM process but I thought it still needs to pad the input data to match the block size, doesn't it? The TLSv1 explicit padding of CBC ciphers is not present in the AEAD ciphers at all. RFC 5288 doesn't define any kind of padding either, which makes me wonder how it is actually implemented... 

Also, if the TLSCompressed.length and TLSCiphertext.length are equal, how is it possible that the AEAD ciphers provide authentication? Shouldn't it at least add the Auth Tag to the message after encryption? Adding authentication without increasing the data length at all sounds a bit difficult. I'm actually more confused after this answer than I was before it.

> The use of TLSCompressed.length mirrors the behaviour of the CBC mode.
> I can imagine an AEAD cipher where it would be nicer if the additional
> data covered the TLSCiphertext.length and may it should be changed,
> although it's all a little nebulous when we don't have an actual
> example of an AEAD cipher which needs it.

If the additional data covered the TLSCiphertext.length, it would be quite difficult to give it to AEAD-Encrypt, because the TLSCiphertext.length is not known before encryption just like TLSCompressed.length is not known before decryption. So I don't think it would solve anything either.

Sorry if my questions are stupid, but it's better to ask than do something incompatible. I would especially be interested in hearing from someone who has implemented the AES GCM mode cipher suites.



Juho