Re: [TLS] Resolution AEAD Cipher length and padding

[Bodo Moeller <[e-mail]>]

Joseph Salowey (jsalowey) <[e-mail]>:
>
>  On Jul 21, 2014, at 7:54 AM, Alfredo Pironti <[e-mail]> wrote:
>
>  It's not clear to me what this resolution is about; could you please
> elaborate (or give pointers)?
> Is this about AEAD ciphers built on top of block-encrypt then mac? To some
> extent, current GCM and CCM ciphers are already expanding the cipher text
> length by the tag length, so I must be missing the point here. Thanks.
>
>
>  [Joe] to clarify:  current AEAD cipher modes (GCM, CCM)  do not expand
> the cipher text through padding, their cipher text length is the same as
> the clear text length.
>

I think the authentication tag (8 octets for these -- RFC 5288 or RFC 6655)
is considered part of the ciphertext for the AEAD interface (RFC 5116) as
used by TLS 1.2 (RFC 5246), so length expansion indeed already takes place.
 So unless I'm missing something, the point actually is that with these the
exact amount of length expansion is implicit (and you can recover
TLSPlaintext.length and thus determine additional_data by subtracting a
constant from the ciphertext length).

Thus, this decision is not about padding per se, but specifically about
*variable* padding, which wouldn't work with the current spec.

Bodo