Re: [TLS] Pull Request: Removing the AEAD explicit IV

[Adam Langley <[e-mail]>]

On Tue, Mar 17, 2015 at 11:06 AM, Michael StJohns
<[e-mail]> wrote:
> That works for the currently defined pure AEAD modes (CCM/GCM at least,
> haven't looked at chacha).   Will that work in all cases for constructed
> AEAD modes?  (e.g. where we build an AEAD mode out of an encryption mode and
> an integrity mode and derive the E and I keys from a single key internal to
> the constructed mode - say  AES-CBC with CMAC for example).  Short answer is
> probably not.

I believe that it will, although I welcome counterexamples.

The AEAD interface requires only an nonce (i.e. unique, but not
unpredictable) and, under this proposal, that's all that TLS will
provide.

CBC modes require an IV (i.e. unpredictable). If you wished to make an
AES-CBC-HMAC-SHA256 AEAD, for example, then you would do something
like this:

Define the key length to be twice as large as the AES key and split it
internally into a CBC key and an IV key. For each record, generate the
IV by AES(key = IV_key, block = nonce) then encrypt the plaintext
using CBC with that IV and the CBC key. (And you might need extra key
bytes for the HMAC too, but that's beside the point here.) Basically
you can generate the IVs using AES-CTR as a PRNG.


Cheers

AGL