Re: [TLS] draft-mcgrew-aead-aes-cbc-hmac-sha2 can't be used as TLS 1.2 AEAD ciphers

[Wan-Teh Chang <[e-mail]>]

Hi David,

Thank you for your reply and suggestions.

Re: CTS: I agree with John that adding CTS would be opposite to the
reason for existence for draft-mcgrew-aead-aes-cbc-hmac-sha2 because
CTS is not widely deployed.

I am more interested in figuring out how TLS can use an AEAD algorithm
that obscures the plaintext length. Consider the additional_data in
TLS 1.2:

   The additional authenticated data, which we denote as
   additional_data, is defined as follows:

      additional_data = seq_num + TLSCompressed.type +
                        TLSCompressed.version + TLSCompressed.length;

The plaintext length (TLSCompressed.length) is the problematic part.
Since the authentication tag of an AEAD algorithm should already cover
either the plaintext length or the ciphertext length, it seems that we
can safely remove TLSCompressed.version from additional_data. We can
consider making this change in TLS 1.3.

Wan-Teh Chang