Subject: Re: [MLS] Message Protection

From: "Alexey Ermishkin" <[email-masked]>
Date: Sun, 1 Jul 2018 13:53:11 +0500

You a right. Even though Double Ratchet spec allows fixing nonce to a
constant, nobody seem to use it.

So, I made amends, fixed typo and did a PR
https://github.com/ekr/mls-protocol/pull/50

-----Original Message-----
From: MLS <[email-masked]> On Behalf Of Martin Thomson
Sent: Friday, June 29, 2018 12:57 PM
To: [email-masked]
Cc: Katriel Cohn-Gordon <[email-masked]>; [email-masked]
Subject: Re: [MLS] Message Protection

On Fri, Jun 29, 2018 at 5:39 PM Alexey Ermishkin
<[email-masked]> wrote:
> I'm not sure if nonce should be also derived as keys will be unique 
> and used only once. It does not seem to affect security in either way. 
> Signal is also using zero nonces for one time keys.

In TLS we chose to derive nonces so that it would become less feasible to do
precomputation attacks.  Messages are often predictable, and if you can
calculate a table for common responses, it might be possible to have enough
values stored to compromise confidentiality.

(That was the argument; not sure how much weight it carries relative to just
using a stronger primitive, but there you have it.)

_______________________________________________
MLS mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/mls