Re: [TLS] WG adoption + early code point assignment: draft-mavrogiannopoulos-chacha-tls

[Yoav Nir <[e-mail]>]

> On May 20, 2015, at 4:21 PM, Eric Rescorla <[e-mail]> wrote:
> 
> 
> 
> On Tue, May 19, 2015 at 11:43 PM, Nikos Mavrogiannopoulos <[e-mail] <mailto:[e-mail]>> wrote:
> ----- Original Message -----
> > I am in favor of this draft.
> >
> > Prior to doing the code point assignment, however, we should resolve
> > the question of the per-record nonce algorithm. The current draft uses
> > an algorithm that is not consistent either with the algorithm we use for
> > GCM or TLS 1.3.
> >
> > - TLS 1.2 GCM: 32-bit fixed salt || 64-bit explicit per-record IV
> > - TLS 1.3: fixed mask XORed with the record sequence number
> > - ChaCha: 32-bit fixed salt || record sequence number
> 
> I think the chacha draft is consistent with the TLS 1.2 GCM draft. The TLS
> 1.2 GCM draft allows as an option (MAY) to have "32-bit fixed salt || record sequence number",
> and in fact all implementations do that. So this draft simply ratifies that
> approach and changes that requirement to MUST.
> 
> Not just that. It also doesn't carry the RSN on the wire, which the GCM one does.

Yes, there’s that. I think that we should leave the record IV (which this draft makes equal to the RSN, while RFC 5288 allows to be chosen in any way)  in the record for TLS 1.2. 
In 1.3 we’re anyway planning to do it differently and omit the IV, so we should do it there for both algorithms
It’s a waste of 8 bytes, but that will give us one more reason to implement 1.3, no?

Yoav