Re: Review (Re: [TLS] I-D ACTION:draft-ietf-tls-ctr-00.txt)

> I have a few questions and thoughts on the TLS-CTR mode I-D:
> 
> On the IV construction:
> 
> I see that the nonce is 48 bits in length.  My recollection of David
> McGrew's analysis of CTR mode is that 64 bits of nonce would provide
> 128-bit security (for a 128bit key and CTR mode).  My question is on
> the level of security 48-bit nonces provide.  I see that 3686 uses a
> 32-bit nonce.  I am confused at what is the right length for the
> nonce.  Some discussion on that might be appropriate in the SEC
> considerations section.  Perhaps David might help clarify (I may have
> misread his paper).

My understanding is that 32-bits of nonce are sufficient to accomodate
for pre-computation attacks on CTR mode.  Though, if there is a problem 
here, then it would apply equally to 3686.

> On the block level counter, 3686 specifies a 32-bit counter citing
> IPv6 Jumbograms' requirement.  SRTP makes a note that for multimedia
> apps, that might be safely ignored.  Could you also make a similar
> note in this document, or perhaps you might also want to support
> jumbograms?  (Perhaps IPv6 historians might tell us whether there are
> practical uses for jumbograms).

The limit on the counter here is to support a TLS record of 2^14 octets.

> I don't think it is sufficient to refer to 3686's security
> considerations.  Those notes are written for a different protocol and
> context.  Perhaps you might copy and paste from there and edit the
> text, if you want to reuse text.

Good point.  That's probably the right thing to do.

Thanks,
nagendra

_______________________________________________
TLS mailing list
TLS@lists.ietf.org
https://www1.ietf.org/mailman/listinfo/tls