[TLS] draft-mcgrew-aead-aes-cbc-hmac-sha2 can't be used as TLS 1.2 AEAD ciphers

[Wan-Teh Chang <[e-mail]>]

While reviewing the NSS patch for the AES-GCM TLS cipher suites, my
colleague Ryan Sleevi noticed that the AEAD algorithms defined in
draft-mcgrew-aead-aes-cbc-hmac-sha2 can't be used as TLS 1.2 AEAD
ciphers. The problem is how TLS 1.2 specifies the additional
authenticated data for AEAD ciphers:

RFC 5246 Section 6.2.3.3 says:

   The plaintext is the TLSCompressed.fragment.

   The additional authenticated data, which we denote as
   additional_data, is defined as follows:

      additional_data = seq_num + TLSCompressed.type +
                        TLSCompressed.version + TLSCompressed.length;

   where "+" denotes concatenation.

So additional_data includes the length of the plaintext
(TLSCompressed.length). But a TLS 1.2 record only gives us the length
of the AEAD ciphertext. So the recipient needs to calculate the
plaintext's length using only the ciphertext.

This is difficult to do with the AEAD algorithms in
draft-mcgrew-aead-aes-cbc-hmac-sha2 because the amount of padding, and
therefore the plaintext length, is only known after CBC decryption.

Is this a known problem with TLS 1.2 AEAD ciphers?

Wan-Teh Chang