Subject: [Cfrg] RFC 5116 update?

From: John Mattsson <[email-masked]>
Date: Wed, 18 Jul 2018 13:32:25 +0000

The situation we have today is that recent IETF standards

- COSE (RFC 8152),
- Encrypted Content-Encoding for HTTP (RFC 8188),
- TLS 1.3 (draft-ietf-tls-tls13),

are not following the recommended nonce formation in Section 3.1 of RFC 5116. Instead they are constructing the nonce as
 
  NONCE = PRF( Shared secret, Public material ) XOR SEQ

and keep the PRF( Shared secret, Public material ) part of the nonce secret. The nonce construction is analyzed in https://eprint.iacr.org/2016/564.pdf showing that it improves the resilience against (passive) mass surveillance. It should also improve the resilience against Grover's algorithm when the effective key length of the shared secret is larger than the AEAD key.

I think RFC 5116 should be updated to describe and recommend the nonce construction used in TLS 1.3. First, it would be good if RFC 5116 and current IETF protocols align. Secondly, I think the new nonce construction should be recommended to new protocols (IETF or non-IETF).

Cheers,
John