Subject: Re: [Emu] Re: On my suggestion to use CTR mode instead of CBC

From: Charles Clancy <[email-masked]>
Date: Mon, 12 Mar 2007 19:27:54 -0500

I think the code sizes for the different modes of operation are 
negligible, but the openssl implementation does indeed manage the 
counter.  See:

     http://www.srcdoc.com/openssl_0.9.7g/aes__ctr_8c-source.html

OpenSSL assumes the lower "num" bytes of the IV are used as the counter. 
  Considering EAP's MTU is 1024, we could only ever have 64 AES blocks 
per packet.  Use 1 byte of the IV for the counter, and the other 15 as 
the IV.

-- 
t. charles clancy, ph.d.  |  [email-masked]  |  www.cs.umd.edu/~clancy

Joseph Salowey (jsalowey) wrote:
> Does the library provide counter management or is that up to the
> implementation? 
> 
>> -----Original Message-----
>> From: Charles Clancy [mailto:[email-masked]] 
>> Sent: Monday, March 12, 2007 2:27 PM
>> To: Clint Chaplin
>> Cc: [email-masked]
>> Subject: Re: [Emu] Re: On my suggestion to use CTR mode instead of CBC
>>
>> FIPS 140-2 defers to SP 800-38a, which includes ECB, CBC, 
>> CFB, OFB, and CTR as allowable block cipher modes of operation.
>>
>> The only RFC specifying AES-CTR (that I can find) is 3686, 
>> which uses it with IPsec ESP.
>>
>> OpenSSL includes support.  See AES_ctr128_encrypt().
>>
>> --
>> t. charles clancy, ph.d.  |  [email-masked]  |  www.cs.umd.edu/~clancy
>>
>> Clint Chaplin wrote:
>>> What does NIST (FIPS) have to say?
>>>
>>> On 3/12/07, Charles Clancy <[email-masked]> wrote:
>>>>  > CTR mode encryption does not include integrity 
>> protection.  There 
>>>> are  > what are known as combined modes, e.g., CCM, OCB, 
>> GCM, which 
>>>> use CTR  > mode for encryption.  I am not talking about 
>> using CCM or 
>>>> something like  > that.
>>>>
>>>> I have no objection to switching from CBC to CTR.  Anyone 
>> else have 
>>>> an opinion?
>>>>
>>>> --
>>>> t. charles clancy, ph.d.  |  [email-masked]  |  www.cs.umd.edu/~clancy
>>>>
>>>> _______________________________________________
>>>> Emu mailing list
>>>> [email-masked]
>>>> https://www1.ietf.org/mailman/listinfo/emu
>>>>
>>>
>> _______________________________________________
>> Emu mailing list
>> [email-masked]
>> https://www1.ietf.org/mailman/listinfo/emu
>>

_______________________________________________
Emu mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/emu