Subject: [nfsv4] draft-11 ssv encryption question

From: Fredric Isaman <[email-masked]>
Date: Tue, 26 Jun 2007 16:25:26 -0400 (EDT)

Regarding the new SSV GSS mechanism...assume that the client and server 
have agreed on using id-aes256-CBC.  What IV should be used?  All zero?

 	Fred

_______________________________________________
nfsv4 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/nfsv4

---

From: Mike Eisler <[email-masked]>
Date: Tue, 26 Jun 2007 15:22:48 -0700 (PDT)

> have agreed on using id-aes256-CBC.  What IV should be used?  All

Sigh. Sorry for missing this.

Just spent some time reading NIST, wikipedia, and IETF docs.

http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf
says (pg 20), the IV need not be secret, but it must be unpredictable.
IPsec ESP and TLS 1.1 deal with this by including a cleartext IV
with each message. 

For draft 11, just use the first 16 bytes of ssct_hmac for the IV.

In theory ssct_hmac is unpredictable, but I am loth to use
something that is partially derived from the plain text. So
for draft 12, I will add an ssct_iv field (variable length so
that if non-AES algorithms are used, different sized IVs can be used).
   
Thanks again for the sanity checks.