Re: [TLS] Consensus for AEAD IV

[Ilari Liusvaara <[e-mail]>]

On Sun, Apr 26, 2015 at 04:26:32PM -0400, Michael StJohns wrote:
> On 4/26/2015 2:20 PM, Ilari Liusvaara wrote:
> >>There is no reason to treat the 96 bit quantity as secret and no one else
> >>>does.
> >Oh, except SSH. The session nonce is 96 bits and secret.
> 
> SSH uses CBC exclusively as far as I can tell.   The fact that the mixin  of
> the first block of the first message (AKA the initial IV) is generated via
> keyed material from the negotiated shared secret is actually a problem
> (similar to the problems in TLS 1.2 and before) and doesn't actually provide
> any security.

SSH can also use:
- CTR (start from 128-bit secret initial IV, no packet boundaries)
- AES-GCM (96 bit secret initial IV, increments per packet)
- Chacha20-Poly1305 (uses message sequence as nonce)

(In fact, I think the semi-offical recommendation is "don't use CBC in SSH").


-Ilari