Re: [TLS] Consensus for AEAD IV

[Michael StJohns <[e-mail]>]

On 4/26/2015 2:20 PM, Ilari Liusvaara wrote:
>> There is no reason to treat the 96 bit quantity as secret and no one else
>> >does.
> (To lesser extent, IPSEC, there the session nonce is 32 bits and secret).
>

This is directly from section 2.3 of the IPSec ESP RFC 4303


> With regard to ensuring the alignment of the (real) ciphertext in the
>     presence of an IV, note the following:
>
>           o For some IV-based modes of operation, the receiver treats
>             the IV as the start of the ciphertext, feeding it into the
>             algorithm directly.  In these modes, alignment of the start
>             of the (real) ciphertext is not an issue at the receiver.
>
>
>           o In some cases, the receiver reads the IV in separately from
>             the ciphertext.  In these cases, the algorithm specification
>             MUST address how alignment of the (real) ciphertext is to be
>             achieved.

And RFC4309 - CCM mode has this:

>  ESP Payload
>
>    The ESP payload is composed of the IV followed by the ciphertext.
>    The payload field, as defined in [ESP], is structured as shown in
>    Figure 1.
>
>        0                   1                   2 3
>        0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
> +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
>       |                     Initialization Vector                     |
>       |                            (8 octets)                         |
> +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
> |                                                               |
>       ~                  Encrypted Payload (variable)                 ~
> |                                                               |
> +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
> |                                                               |
>       ~                 Authentication Data (variable)                ~
> |                                                               |
> +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+



Again, newer modes may have done something else, but the above is strong 
indication that IVs were not generated as secrets as a general matter.

Later, Mike