Re: [TLS] Consensus for AEAD IV

[Michael StJohns <[e-mail]>]

On 4/26/2015 4:34 PM, Ilari Liusvaara wrote:
> On Sun, Apr 26, 2015 at 04:26:32PM -0400, Michael StJohns wrote:
>> On 4/26/2015 2:20 PM, Ilari Liusvaara wrote:
>>>> There is no reason to treat the 96 bit quantity as secret and no one else
>>>>> does.
>>> Oh, except SSH. The session nonce is 96 bits and secret.
>> SSH uses CBC exclusively as far as I can tell.

*sigh* I looked at the original SSH rfc and for some reason none of the 
new modes were added to that RFC as "Updates".

>>   The fact that the mixin  of
>> the first block of the first message (AKA the initial IV) is generated via
>> keyed material from the negotiated shared secret is actually a problem
>> (similar to the problems in TLS 1.2 and before) and doesn't actually provide
>> any security.
> SSH can also use:
> - CTR (start from 128-bit secret initial IV, no packet boundaries)
> - AES-GCM (96 bit secret initial IV, increments per packet)
> - Chacha20-Poly1305 (uses message sequence as nonce)
>
> (In fact, I think the semi-offical recommendation is "don't use CBC in SSH").

The fact that SSH was designed with CBC and that you got no security 
from CBC by doing it this way is the key point.  The fact that new modes 
have come along and just used what they were handed doesn't really add 
to the "the IV must be secret" argument.

In other words, it wasn't done this way originally to increase security 
so using it as an example for good practice is probably somewhat bogus.


>
>
> -Ilari
>
>