Re: [TLS] ChaCha and IVs

[Alyssa Rowan <[e-mail]>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

(Just popping by briefly on this one.)

On 04/03/2014 18:56, Adam Langley wrote:

> I feel this is a problem that FIPS needs to sort out (they don't
> have a concept of an AEAD, I assume). I'm unwilling to have the
> whole world waste bandwidth, and have a more dangerous
> specification, because of a bureaucratic problem.

A strong +1 on this.

Random IVs risk collision earlier, burn valuable entropy faster, and
are far more fragile.

Sequential IVs are deterministic, verifiable, debuggable, and implicit.

It is crystal-clear to me that sequential IVs are the correct
approach. I would be interested to hear NIST's reasons for
recommending otherwise.

ChaCha20 and Poly1305 are, of course, not in the FIPS catalogue, so
it's moot.

In a wider sense, given recent discoveries about extremely critical
parts of widely-used TLS stacks, perhaps limiting the scope of reviews
to crypto primitives would be unwise in any event: certified crypto
doesn't do any good when it's skipped over.

- -- 
/akr
-----BEGIN PGP SIGNATURE-----

iQIcBAEBCgAGBQJTFyZ+AAoJEOyEjtkWi2t6uyIP/3Gl18noWkYo28+1WQ6qFxAG
L0t30TiMSTxZpRsMH5Z21wrrYvNb+5R9Pv3RqBVNMl6Svhz5u3HAqLvXQf1qtZr5
z5C6qejElVGKBFapkdl8QZ6WKn2PLUfF0/elCc9OPfL9WBRousEB8UTOVQ73Hfut
kkLTdk2FTJUGnt2DaZwInvUQFqjdC3uvMq2/pyUUL4RTmckc3h5LCET4nBpYdZAJ
Oq2XLIKzdIrtDQVHPYq2xLs+Ul6/CZPkp4/h9/zOIKxSK/XI72KYxc5H+sz+g2xz
CwX8AYycs4nQ6NAQ/VgcDviIR5h8D94OUcawWrdxzstgjDadfPevLH5XPZOnDBAw
TTEiNkzpaqTwm24++bf/MhC5ZEH6MktBXUyUl6rN0zwc7vcNBOFNs5rxCbpD+Di2
wQdZbUj9Tanh3yn5upWKDC6rt4sPYmdF/Mhv6YM1LP3H4JpVziHPozj24wUVkXuO
6FDLbJxTSOHwRmQzQ5vgtOBHzDz9af7kCq9fKEwoH5Dv21lYI/X3fvWuLjW3Nqya
CI9+or1uN2qKDgTWfhGrj42Iu3PVJ/zpR77UqcYPElezacKHvrD7vJbYeU9XeCkE
yHE6qoIyDLLa5QWkQoBPF1C7bwATaJfXB5Zj3QZ4qXwU/ZyJju6HS07wUEaXRS8g
mZoa6PrFjSGwwWTZ1YzS
=/uMb
-----END PGP SIGNATURE-----