Re: [TLS] Pull Request: Removing the AEAD explicit IV

[Brian Smith <[e-mail]>]

Eric Rescorla <[e-mail]> wrote:
> Adam, Brian, what would you think of XOR rather than addition?
>
> E.g., generate a per-connection value V and then do:
>
> Nonce = Seq XOR V?

Would the sequence number be logically the same size as the nonce (128
bits or 256 bits), or would the spec will forbid sending 2^64 or more
records under the same key? Either solution prevents the need to worry
about the record number overflowing, but my answer depends on which
approach is chosen.

The advantage of XOR is that it is easy to implement correctly,
because mutli-machine-word XOR is easier to implement than
multi-machine-word unsigned integer addition with wraparound during
overflow. However, XOR is also easier to implement *wrongly* without
anybody noticing, by only doing the XOR for a single machine word
(e.g. only the lower 32 bits on a 32-bit machine). It's not so
practical to do a conformance test that sends/receives 2^32+1 or
2^64+1 records..

It seems harder to implement addition wrongly without anybody noticing
because all of the overflow cases should be triggered during interop
testing and thus any bugs found and corrected. So, without knowing the
answer to my question above, I prefer addition.

Cheers,
Brian