Re: [TLS] Choice of Additional Data Computation

[chris - <[e-mail]>]

>
> But I'd like to hear Chris weigh in on whether he thinks we should have
> them explicitly in the AD (and whether that should be true in QUIC too).
>

I would need to study the specs in order to provide an intelligent answer
here. Off the hip, it would seem to depend on how the boundaries between
record headers and ciphertexts are determined. Taking a quick look at
draft-37, Fig. 4: the "full" header includes three values that are excluded
from the "minimal" header, the length of the ciphertext being one of the
fields. Presumably, when using the "minimal" header, the length is a
parameter that the sender and receiver already agree on. If this is case,
then I don't see a need to add the length to the AD. If the attacker
manages to convince the receiver to use the wrong length parameter (maybe
this is negotiated during the handshake?), then as Ekr points out, AEAD
decryption would fail, thereby "implicitly authenticating the input length".

Chris P.