Re: [TLS] ChaCha and IVs

[Dr Stephen Henson <[e-mail]>]

On 05/03/2014 17:44, Robert Cragie wrote:
> This seems to be a non-issue to me. In SP 800-38D section 8.2.1, the
> deterministic construction is described using an IV with an invocation field. If
> the invocation field is specified as an integer counter, it will, by definition,
> increment by one every time the AES-GCM encrypt function is invoked for a
> particular key. Maybe I missed it, but I didn't notice the requirement that the
> invocation field starts at a random starting point? Therefore, this could start
> at 0 on provision of a new key and also be the basis of the sequence number. If
> there is insistence that this is generated within a cryptographic module for
> validation purposes, in the TLS case, the module would use the deterministic
> construction with the invocation field as an integer counter and export the
> invocation field to form the TLS sequence number. In this way, there would be no
> need to have to supply any additional code as part of the validation.
> 


SP800-38D is combined with the FIPS 140-2 implementation guidance (IG) during
FIPS 140-2 validation. In this case IG A.5 is relevant for AES-GCM and IVs.

The IG can modify the requirements of other standards (e.g. restrict them) for
the purposes of FIPS 140-2. A deterministic IV from SP800-38D 8.2.1 looks like
it falls under IG A.5 3.A:

"A. Each deterministically established IV shall include an encoding of the
module’s name and the name shall be long enough to allow for at least 32^2
different names."

Which presumably isn't something we'd do for TLS.

There is of course some guesswork involved here in that any future FIPS spec and
IG would be similar to that for AES-GCM. In the case of AES-CCM there aren't any
IV internal generation requirements AFAIK.

Steve.
-- 
Dr Stephen N. Henson.
Core developer of the   OpenSSL project: http://www.openssl.org/
Freelance consultant see: http://www.drh-consultancy.co.uk/
Email: [e-mail], PGP key: via homepage.