Re: [TLS] ChaCha and IVs

[Bodo Moeller <[e-mail]>]

Stephen Kent <[e-mail]>:

Anyone who has had a product evaluated will
> tell you that the goal is always to minimize the amount of code that is
> subject
> to review. If one were to use a TLS (or ESP) sequence number for an IV,
> all of
> the protocol code would be part of the evaluation, and that would make the
> evaluation prolonged and very costly.
>

I suppose if this becomes an actual concern for evaluation, you could
create a more easily evaluable module that accepts explicit IVs but checks
that these increase monotonically between invocations.  (Accepting
*explicit* IVs doesn't mean you have to accept *arbitrary* IVs.)

(Implicitly, this would also enforce the TLS requirement that sequence
numbers are not allowed to wrap around once you're beyond 2^64 records.)