Re: [TLS] Pull Request: Removing the AEAD explicit IV

[Brian Smith <[e-mail]>]

Watson Ladd <[e-mail]> wrote:
> If we're going to make a change this
> radical, why not make equally radical changes to simplify the protocol
> further if that's possible?

That's already happening.

> I'm also not sure what we're supposed to
> be gaining from this change: while it's true that we don't need to
> send the explicit nonce, I don't know that we are losing anything from
> having it.

1. The explicit nonce is a place to potentially leak secret data.
2. The explicit nonce is a place where a PRNG could be used poorly,
and/or a poor PRNG could be used.
3. Security properties of an explicit nonce cannot practically be
verified by the receiver, whereas the receiver could (and in fact
would have to) verify that an implicit nonce based on the record
sequence number is safe.
4. The implicit IV reduces per-record overhead on the wire by 16 or 32
bytes. For some applications that's substantial.

There are other advantages that aren't so simple to describe.

> Yes, I know the ChaCha draft does it a seemingly more
> sensible way, but the last thing we need is to further increase the
> codesize of TLS implementations.

This change would not contribute substantial complexity to most TLS
libraries that would implement it. Most TLS libraries already have
similar logic to deal with implicit vs. explicit IVs in CBC mode for
SSL3/TLS1 vs. TLS 1.1+.

Also, the proposed changes to the handshake state machine for TLS 1.3
are much larger. It seems we can't substantially simplify the protocol
proportionately increasing the complexity of implementations that need
to also implement earlier versions.

Cheers,
Brian