Re: [TLS] NIST TLS recomendations (IV generation)

It seems to me, that the proposed wording rules out procedure 2 and 
the alternate procedure, as in those procedures it is not the IV, but 
the first encrypted block which is unpredictable. Not that I have a 
problem with that --  it seems like it would be good for 
compatibility if TLS clients were consistent about whether the first 
block of the message is sent up to the application layer. Speaking of 
which, what is the standard procedure for a TLS 1.1 client to 
determine whether or not the first block of a decrypted message 
should be ignored?

At 12:42 PM 11/21/2006, Bodo Moeller wrote:

>On Tue, Nov 21, 2006 at 12:25:04PM -0500, Blumenthal, Uri wrote:
>
> >>> For the 1st statement how about:
> >>>
> >>>     The IV SHOULD be chosen at random, and MUST be
> >>>     unique and unpredictable.
> >>>
> >>> (based on crypto wisdom :-)
>
> >> I'd like to align the text with NIST SP 800-38A, which doesn't
> >> require uniqueness for CBC mode (and for other modes where
> >> uniqueness is required, generating the IV randomly is not
> >> usually acceptable).
>
> > I guess I have an issue with SP 800-38A then :-).
>
> >> So how about "The Initialization Vector (IV) SHOULD be
> >> chosen at random, and MUST be unpredictable" ?
> >>
> >> (This text is in section titled "CBC block cipher",
> >> so no need to consider OFB or CTR here...)
>
> > Well, I still would like to see at least "SHOULD be unique", but since
> > we are aligning with the official standard (and the issue is indeed
> > rather improbable for CBC) - I'm leaving it to the others to decide. No
> > strong push from my side in either direction.
>
>Being unpredictable makes the IVs unique except with negligible
>probability (unless you've used CBC on too long a data stream), so
>there's no need for an explicit uniqueness requirement.
>
>If we write "MUST be unique", this might evoke the perception that
>implementations using randomly generated IVs are expected to check
>whether these actually are unique, which usually is totally
>impractical, and totally unnecessary.
>
>So "SHOULD be chosen at random, and MUST be unpredictable" looks
>exactly right to me.
>
>Bodo

_______________________________________________
TLS mailing list
TLS@lists.ietf.org
https://www1.ietf.org/mailman/listinfo/tls