Re: [TLS] Consensus call on Implicit IV for AEAD

[Martin Thomson <[e-mail]>]

On 3 April 2015 at 20:17, Brian Smith <[e-mail]> wrote:
> a clear record of my objection to the
> zero-padding mechanism on the mailing list,

For the record then, the objection was this:

If you are concerned that someone might spend a large amount of
computing resources (2^60+ iterations) to gain themselves a reasonable
chance of decrypting a randomly selected session from a similar sized
set of sessions, pick a stronger cipher.

There's a history of attempting to paper over perceived weaknesses in
the crypto we use.  I get the belt and braces approach here, but I'd
rather see us develop stronger constructions (ChaCha+Poly uses a
longer key, for example).

If the complaint is specific to AES-GCM, I see nothing stopping
someone from proposing AES-GCMv2 that operates on extra keying
material internally in order to make the IV unpredictable.  I'd rather
keep the nonce sane though, it keeps it easy to reason about the
construction.