Re: [TLS] Consensus call on Implicit IV for AEAD

[Yoav Nir <[e-mail]>]

> On Apr 6, 2015, at 4:10 AM, Tom Ritter <[e-mail]> wrote:
> 
> On 3 April 2015 at 15:34, Joseph Salowey <[e-mail]> wrote:
>> In the interim meeting we had consensus to use an implicit IV for AEAD.  The
>> proposal was to use the record sequence number and pad with zeros as
>> described in pull request 155
>> (https://github.com/tlswg/tls13-spec/pull/155/files).  This was also
>> discussed in the IETF-92 meeting in Dallas along with options to change the
>> offset.  The consensus was to stay with the original proposal.  We are
>> posting to the mailing list to confirm this consensus. If you have comments,
>> please reply by April 17, 2015.
> 
> 
> I apologize if I'm mistaken or this has been raised previously, but I
> feel compelled to speak up and not assume it has.
> 
> The record sequence number is predictable. It's not in the clear on
> the wire, but it begins at 0 and increments with every record.
> (Right?)

Yes, and in DTLS it’s even transmitted on the wire.

> This will result in a predictable IV for the AEAD mode.  We have two
> AEAD modes today:
> - GCM - IV must be unique, being predictable doesn't matter (Right?)
> - poly1305 - IV/Nonce must be unique, being predictable doesn't matter (Right?)

Yes to both questions. There’s also CCM and OCB and it’s true for them as well.

> But we also don't know what AEAD modes we will add in the future.  I'm
> far from being 'up' on the CAESER competition, but I skimmed the first
> ~10 entries, and one, CMCC  is based on CBC mode. It seems like a
> predictable IV = BEAST.  Am I right in thinking we will be
> pigeonholing ourselves into only allowing AEAD modes that do _not_
> require an unpredictable IV?

So either IVs (actually nonces) are compressible only for such ciphersuites that support using the record counter as nonce/IV (add a flag to the registry), or else we use some method such as AGL’s for generating unpredictable IVs from predictable nonces.

Yoav