IETF Logo Mail Archive

Re: [TLS] ChaCha and IVs

Dr Stephen Henson <lists@drh-consultancy.co.uk> Wed, 05 March 2014 13:47 UTC

Return-Path: <lists@drh-consultancy.co.uk>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D38761A03D8 for <tls@ietfa.amsl.com>; Wed, 5 Mar 2014 05:47:31 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.111
X-Spam-Level:
X-Spam-Status: No, score=-1.111 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_NEUTRAL=0.779, T_HK_NAME_DR=0.01] autolearn=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id OVLk8WV0jwMG for <tls@ietfa.amsl.com>; Wed, 5 Mar 2014 05:47:29 -0800 (PST)
Received: from claranet-outbound-smtp03.uk.clara.net (claranet-outbound-smtp03.uk.clara.net [195.8.89.36]) by ietfa.amsl.com (Postfix) with ESMTP id A32761A0072 for <tls@ietf.org>; Wed, 5 Mar 2014 05:47:29 -0800 (PST)
Received: from drh-consultancy.demon.co.uk ([80.177.30.10]:54879 helo=[192.168.7.9]) by relay13.mail.eu.clara.net (relay.clara.net [81.171.239.33]:10465) with esmtpa (authdaemon_plain:drh) id 1WLCAN-0008WE-BC for tls@ietf.org (return-path <lists@drh-consultancy.co.uk>); Wed, 05 Mar 2014 13:47:23 +0000
Message-ID: <53172AE6.1000300@drh-consultancy.co.uk>
Date: Wed, 05 Mar 2014 13:47:18 +0000
From: Dr Stephen Henson <lists@drh-consultancy.co.uk>
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:24.0) Gecko/20100101 Thunderbird/24.3.0
MIME-Version: 1.0
To: tls@ietf.org
References: <53160513.20703@bbn.com> <1393955839.20861.20.camel@dhcp-2-127.brq.redhat.com> <53161BA7.3070405@drh-consultancy.co.uk> <CAL9PXLzMiq-WsaAO8Q=kWqbQ3taw-xtuNw_ffuZxjFUXCEEG9A@mail.gmail.com> <5317267F.1070909@akr.io>
In-Reply-To: <5317267F.1070909@akr.io>
X-Enigmail-Version: 1.6
Content-Type: text/plain; charset="ISO-8859-1"
Content-Transfer-Encoding: 7bit
Archived-At: http://mailarchive.ietf.org/arch/msg/tls/tUq7DU7yAMrdFJeRpdo_4WeQvIY
Subject: Re: [TLS] ChaCha and IVs
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 05 Mar 2014 13:47:32 -0000

On 05/03/2014 13:28, Alyssa Rowan wrote:
> 
> Random IVs risk collision earlier, burn valuable entropy faster, and are
> far more fragile.
> 
> Sequential IVs are deterministic, verifiable, debuggable, and implicit.
> 
> It is crystal-clear to me that sequential IVs are the correct approach. I
> would be interested to hear NIST's reasons for recommending otherwise.
> 

In the case of AES-GCM the relevant FIPS specifications *do* permit sequential
IVs. One permitted construction is a random starting point generated within
the module which is then incremented on each invocation.

That "random starting point" requirement means you can't use the sequence
number directly though.

One way round that would be to have a way to specify the starting point. An
explicit IV in the first record for example, but that looks messy to me.

Steve.
-- 
Dr Stephen N. Henson.
Core developer of the   OpenSSL project: http://www.openssl.org/
Freelance consultant see: http://www.drh-consultancy.co.uk/
Email: shenson@drh-consultancy.co.uk, PGP key: via homepage.

v2.23.0 | Report a Bug | By Email