Re: [TLS] ChaCha and IVs

[Andy Lutomirski <[e-mail]>]

On 03/05/2014 04:59 PM, Nico Williams wrote:
> On Wed, Mar 5, 2014 at 6:35 PM, Bodo Moeller <[e-mail]> wrote:
>> I suppose if this becomes an actual concern for evaluation, you could create
>> a more easily evaluable module that accepts explicit IVs but checks that
>> these increase monotonically between invocations.  (Accepting *explicit* IVs
>> doesn't mean you have to accept *arbitrary* IVs.)
> 
> This.
> 
> However in the DTLS case there's no way to make the sequence numbers
> be monotonic.  What the module could do is keep its own IV sequence
> number window and reject the use of sequence numbers that are too old
> or reused...

DTLS is fine with strictly monotonic *encryption* sequence numbers,
right?  And I don't think it's a problem if an AEAD is asked to
*decrypt* repeated sequence numbers.  (It's certainly a problem if an
attacker can access the decryption of two different messages with the
same sequence if they don't both verify, but this is solvable by having
the crypto implementation refuse to supply the supposed plaintext if the
tag is bad.)

--Andy