Re: [TLS] Choice of Additional Data Computation

[Felix Günther <[e-mail]>]

Hi,

On 2020-05-17 07:35 +0200, Hanno Becker <[e-mail]> wrote:
> So, we're here at the moment:
> (1) Only the CID issue really _needs_ fixing somehow.
> (2) Other header fields are currently authenticated through a mixture of
> AAD, nonce, and implicit properties of the AEAD,
> and proof complexity doesn't seem to grow significantly because of that
> non-uniformity (the latter was slightly in doubt
> so far for epoch authentication, but Ekr's remark clarifies that it
> isn't actually the case). 
> (3) No security issues with the proposed alternative -- uniformly
> pseudo-header based AAD -- have been raised yet.
> (4) Non-security arguments for a pseudo-header AAD have been proposed,
> e.g. network bandwidth reduction.
> Those aren't discussed until the question of security reaches some clarity.
> 
> Felix, could you give some input on (3) as detailed in my last post? 

Our security analysis doesn't speak to (3) --- I added some more
detailed remarks in reply to your last post. Cearly, you wouldn't
achieve the same security definition (as headers are intentionally
malleable). Whether that's a problem or not depends on the goal, and if
you can indeed prove the corresponding, to-be-formalized security
statements.


Cheers,
Felix