[TLS] Pull Request: Removing the AEAD explicit IV

[Eric Rescorla <[e-mail]>]

PR: https://github.com/tlswg/tls13-spec/pull/155
Target merge date: 3/21

Currently:

- AES-GCM uses a partially explicit nonce
- The ChaCha20 draft uses the sequence number as the nonce.

As Stephen Kent has observed, the idea behind the explicit IV is to allow
the
cryptographic module implementing the AEAD algorithm to ensure non-reuse
of the nonce. However, for ChaCha I believe we came to the conclusion that
it
was acceptable to use the sequence number as the nonce, as the module can
check for sequential usage. This saves 8 octets on the wire.

In the interim in Seattle, we came to the conclusion that we should make
all AEAD algorithms behave this way, which also simplifies the spec some.
I've formatted this into a PR to verify the consensus on the list. Please
comment
here if you object and on the PR if you have editorial comments.

https://github.com/tlswg/tls13-spec/pull/155

-Ekr