Re: [TLS] Pull Request: Removing the AEAD explicit IV

[Michael StJohns <[e-mail]>]

On 3/18/2015 11:58 AM, Eric Rescorla wrote:
>
>
> On Wed, Mar 18, 2015 at 8:48 AM, Michael StJohns 
> <[e-mail] <mailto:[e-mail]>> wrote:
>
>
>
>     David used Nonce properly here, but it becomes confusing when
>     taken to using the same key with multiple messages.
>
>
>     Each message ALSO needs a Nonce - e.g. a unique value. But the
>     other term for a per-message nonce is generally an IV.  At the
>     message level a nonce is always an IV but an IV isn't always a nonce.
>
>
> The term in RFC 5116 uses for this input is "nonce". I don't think 
> it's helpful
> to use a different term here than is used in RFC 5116. Please note that
> all the ciphers here need to conform to the RFC5116 interface, so whatever
> the individual ciphers call their nonce inputs is not relevant here.

David used David's language for 5116.  It's instructive to note Russ's 
language in the CCM RFC matches what ended up in the NIST version, but 
that David's language in his GCM RFC didn't match what ended up in the  
document he sent proposing GCM to NIST nor what NIST finally published 
as the mode.  I'm not sure why that is. From David's GCM submission:

> The primary purpose of the IV is to be a nonce, that is, to be 
> distinct for each invocation of the encryption operation for a fixed key.

Then there's the mixture of the IV with the salt to form a nonce in the 
GCM IPSEC document that's yet another different way of putting it.

If you say "IV" or Initialization Vector - I know that's the value I 
need to begin encryption or decryption of a message.  If you say Nonce, 
I have no idea of whether its an IV, a value mixed in to indicate 
timeliness (e.g. a challenge nonce), a per-session/per-sender nonce 
that's used as part of the IV to allow the same key to be used by 
multiple senders or what.

Ah well....


>
>
>     We form the per-message nonce (e.g. the IV) from the per-session
>     nonce and the per-message sequence number and a fixed value. 
>     That's also the per-block nonce for the first block.
>
>
> In this PR there is no fixed value. We simply use the sequence number 
> and pad to
> the left as required, so I don't think there should be much room for 
> confusion.

This is kind of sophistry.  Padding to the left is exactly equivalent to 
"fixed nonce of zeros".

>
> -Ekr
>