Re: [TLS] Inclusion of OCB mode in TLS 1.3

[Jack Lloyd <[e-mail]>]

On Tue, Jan 20, 2015 at 08:18:21PM +0100, Aaron Zauner wrote:
> Hi TLS-WG,
> 
> The Internet Draft can be found over here:
> https://datatracker.ietf.org/doc/draft-zauner-tls-aes-ocb/

My initial understanding on reading the draft was that in the nonce construction
the sequence number is implicit (or already explicit in the message in the case
of DTLS), and the record_iv_length of these ciphersuites is zero. However it
then refers to RFC 5288 (the GCM ciphersuite definition), which includes an
explicit 8 byte nonce in each message. Or is this reference purely with regards
to the formatting of the nonce input to the AEAD algorithm? Even just an
additional statement "The record_iv_length is X." should resolve this.

If anyone is interested in interop testing, I have implemented these ciphersuites
(assuming record_iv_length is 0) for the next release of botan (available via
https://github.com/randombit/botan) using ids in the private use range.

Cheers,
  Jack