Re: [TLS] ChaCha and IVs

[Nico Williams <[e-mail]>]

On Wed, Mar 5, 2014 at 7:19 PM, Andy Lutomirski <[e-mail]> wrote:
> On 03/05/2014 04:59 PM, Nico Williams wrote:
>> However in the DTLS case there's no way to make the sequence numbers
>> be monotonic.  What the module could do is keep its own IV sequence
>> number window and reject the use of sequence numbers that are too old
>> or reused...
>
> DTLS is fine with strictly monotonic *encryption* sequence numbers,
> right?  And I don't think it's a problem if an AEAD is asked to

But DTLS is intended to be used with transports that do not guarantee
in-order delivery, so on the receive side at least there's a need to
permit out-of-order sequence numbers.

On the send side too, for concurrency reasons, there's a need to
permit out-of-order generation.  (N threads sharing a DTLS connection,
each using an atomic increment operation to get the next sequence
number, then proceeding at their own pace do to the rest.)

> *decrypt* repeated sequence numbers.  [...]

As long as the app gets the sequence number out so it can check for replays...

Nico
--