[TLS] Thoughts on Hardware Support

[Watson Ladd <[e-mail]>]

Dear all,

A while ago I promised Michael St. Johns to think hard about his goal
of making it possible to use hardware to secure the record layer
without dirty hacks. For those unaware of the problem, the same key is
used to derive encryption keys that shouldn't go out on the wire, and
IVs that do, and so it becomes difficult to ensure that keys can't be
leaked, if you expose the IV generation.

I think the easiest way is to eliminate the IV derivation entirely,
and have the record layer send the entire nonce each time. if that's
too much a waste of bandwidth, then we can specify entirely the
portion that is in TLS 1.2 derived from the MS. I think this is in
spirit similar to his proposal, but I don't recall the exact details.

I'm sure there are disadvantages of this change I am missing, or
aspects of the problem that I'm neglecting, but I seem to recall this
being the major issue.

Sincerely,
Watson Ladd