Re: [TLS] Consensus for AEAD IV

[Michael StJohns <[e-mail]>]

On 4/26/2015 2:20 PM, Ilari Liusvaara wrote:
>> There is no reason to treat the 96 bit quantity as secret and no one else
>> >does.
> Oh, except SSH. The session nonce is 96 bits and secret.


(I'll get back to the rest of your message later,  but let me dispose of 
the above first).


Not exactly.  It turns out that the IV of each SSH message is the Cipher 
text of the last block of the previous message.  Which - since it's 
cipher text - is transmitted and known to everyone who can intercept the 
message stream.

SSH uses CBC exclusively as far as I can tell.   The fact that the 
mixin  of the first block of the first message (AKA the initial IV) is 
generated via keyed material from the negotiated shared secret is 
actually a problem (similar to the problems in TLS 1.2 and before) and 
doesn't actually provide any security.

Let me be blunt:  IVs are NOT secrets and you should not impute 
additional security by encrypting them or otherwise deriving them in a 
non-public manner.

Mike