RE: [TLS] NIST TLS recomendations (IV generation)

>I'd like to align the text with NIST SP 800-38A, which doesn't 
>require uniqueness for CBC mode (and for other modes where 
>uniqueness is required, generating the IV randomly is not 
>usually acceptable).

I guess I have an issue with SP 800-38A then :-). 

>So how about "The Initialization Vector (IV) SHOULD be 
>chosen at random, and MUST be unpredictable" ?
>
>(This text is in section titled "CBC block cipher",
>so no need to consider OFB or CTR here...)

Well, I still would like to see at least "SHOULD be unique", but since
we are aligning with the official standard (and the issue is indeed
rather improbable for CBC) - I'm leaving it to the others to decide. No
strong push from my side in either direction.

:-)

-----Original Message-----
> From: ext Blumenthal, Uri [mailto:uri.blumenthal@intel.com] 
> Sent: 21 November, 2006 18:12
> To: Eronen Pasi (Nokia-NRC/Helsinki); ray.perlner@nist.gov; 
> tls@lists.ietf.org
> Subject: RE: [TLS] NIST TLS recomendations (IV generation)
> 
> Pasi,
> 
> For the 1st statement how about:
> 
> 	The IV SHOULD be chosen at random, and MUST be 
> 	unique and unpredictable. 
> 
> (based on crypto wisdom :-)
> 
> -----Original Message-----
> From: Pasi.Eronen@nokia.com [mailto:Pasi.Eronen@nokia.com] 
> Sent: Tuesday, November 21, 2006 10:37 AM
> To: ray.perlner@nist.gov; tls@lists.ietf.org
> Subject: RE: [TLS] NIST TLS recomendations (IV generation)
> 
> Ray Perlner wrote:
> > Page 20-21: Section 6.2.3.2 under IV The document specifies that the
> > IV SHOULD be generated by method (1) or (2) and MAY be generated by
> > an alternate method. There is, however, no language forbidding the
> > generation of IVs by a fourth unlisted method. If a fourth method is
> > used, the protocol will not fail but may be insecure. Therefore we
> > recommend adding language forbidding the use of an unlisted method
> > for IV generation.
> 
> Actually the whole text about IVs is quite long, and contains
> implementation details that IMHO are likely to confuse rather than
> help an implementer.
> 
> How about just replacing the whole text about IVs with something
> like this?
> 
>    IV
> 
>        The Initialization Vector (IV) MUST be chosen at random, and
>        MUST be unpredictable. See [SP800-38A] Appendix C for
>        RECOMMENDED methods for generating unpredictable IVs.
> 
>        It is critical that the IV is not sent before the entire
>        plaintext of the record is known; otherwise it is possible for
>        the attacker to mount the attack described in [CBCATT].
> 
>        Note: In versions of TLS prior to 1.1, there was no IV field,
>        and the last ciphertext block of the previous record (the "CBC
>        residue") was used as the IV. This was changed to prevent the
>        attacks described in [CBCATT].
> 
> Best regards,
> Pasi

_______________________________________________
TLS mailing list
TLS@lists.ietf.org
https://www1.ietf.org/mailman/listinfo/tls