[TLS] ChaCha and IVs

[Stephen Kent <[e-mail]>]

For those who did not attend or remotely participate in the TLS WG meeting
on 3/4/14, EKR suggested that I draw your attention to the slides I 
presented.

The focus of my presentation was a suggestion that ChaCha, when its used 
as a
cipher suite for DTLS, use an explicit IV for the per-packet unique value,
not re-use the DTLS record number (to save space).

I reviewed several reasons for this, based on discussions that took place in
the IPsec WG several years ago, when we considered the same topic for 
AES counter
mode use with ESP. We decided to require each packet to carry an IV 
independent of
the ESP sequence number (or extended sequence number). Slide 5 of my 
presentation
enumerates reasons for not re-using a packet/record sequence number for 
an IV.
I also noted (Slide 3) that the proposal to use ChaCha with ESP follows the
approach we have adopted for other algorithms, and thus it is preferable 
that
DTLS use the same approach, to enable common hardware and software 
implementations
to support both protocols.

Steve