Re: [TLS] Call for Consensus on removal of renegotiation

[Nikos Mavrogiannopoulos <[e-mail]>]

On Thu, 2014-06-26 at 18:48 +0300, Yoav Nir wrote:

> > Current FIPS states that you can't encrypt more than 64GiB with a single key
> > using AES-GCM. It's not a lot, and it is definetely in the realm of possibility
> > even for HTTPS (games, disk images), let alone actually long lived connections…
> That number seemed suspiciously low, so I went and read SP-800-38D.
> It recommends two different limits depending on the length of the IV.
> For IVs that are constructed deterministically, but whose length is *not* 96 bits, the limit is 2^32 invocations. 2^32 invocations means 4 billion TLS records, which could be up to 16 Terabytes.
> But that doesn’t matter anyway, because in TLS the recommendation is to create the nonce deterministically and the length *is* 96 bits, so the limit is 2^64 invocations. 
> Even with 1-byte records, that’s more terabytes than we know what to do with.
> So I stand by what I said earlier. Just because of volume, there is no reason to rekey an AES session.

That's true for TLS. DTLS has its record counter is limited to 2^48
bits, and that could require a rekey as it is often used for long-lived
VPN sessions. Of course this call is about TLS though.

regards,
Nikos