Re: [TLS] ChaCha and IVs

[Wan-Teh Chang <[e-mail]>]

Hi,

I researched the FIPS validation of AES-GCM recently. My conclusion
was that using an externally-provided nonce/IV for AES-GCM is
acceptable for FIPS 140-2 validation.

Details:

On the NIST AES algorithm validation list
(http://csrc.nist.gov/groups/STM/cavp/documents/aes/aesval.html),
please search for "GCM". You will see several validated GCM
implementations with "IV Generated: ( Externally )".

A specific example that you can inspect easily is AES Certificate
#2216, for the CNG in Windows 8:
http://csrc.nist.gov/groups/STM/cavp/documents/aes/aesval.html#2216

This AES algorithm certificate is part of FIPS 140-2 validation
certificate #1892
(http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/1401val2013.htm#1892).
Its security policy states that the BCryptEncrypt  function is used
for AES-GCM encryption. The BCryptEncrypt function requires the caller
to provide the nonce for AES-GCM. See the pbNonce field of the
BCRYPT_AUTHENTICATED_CIPHER_MODE_INFO structure described at
http://msdn.microsoft.com/en-us/library/windows/desktop/cc562981(v=vs.85).aspx

So I concluded that an AES-GCM implementation that only accepts
externally-provided nonce/IV can still be FIPS validated.

Also, in certain cases, a crypto module can verify that the
externally-provided nonces/IVs are not repeated. For example, if the
nonces are generated by a counter, the crypto module can easily verify
they are monotonically increasing. This approach as an alternative to
an internal IV generator is also described in David McGrew's draft:
https://tools.ietf.org/html/draft-mcgrew-iv-gen-03#section-5.1

Note: I worked on the FIPS 140-2 validation of a software crypto
module at Level 2
(http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/1401val2007.htm#814),
so I am not completely ignorant of FIPS validation issues.

Wan-Teh Chang