Subject: Even more ways to fix the cbc-mode attack

From: Bill Sommerfeld <[email-masked]>
Date: Wed, 20 Mar 2002 13:31:56 -0500

Since TLS has the same CBC attack problem, I attended that WG...

Eric Rescorla mentioned a few ideas which had been kicked around on
TLS for fixing the problem.

In addition to the ones that have been mentioned already either on the
list or in Monday's meeting, there are:

	- stream-like modes (CTR, OFB)
	- explicit IV

Eric also mentioned two other ideas which allow the continued use of
CBC mode:

 - use an implicit pseudorandom IV (i.e., both sides run counter mode
or what have you with a different key just to generate the IV)

 - move the MAC to the start of the packet and (somehow) use that as
the IV.

There didn't seem to be consensus in that group on the right answer,
either...

						- Bill

---

From: Darren J Moffat <[email-masked]>
Date: Wed, 20 Mar 2002 11:54:11 -0800 (PST)

> There didn't seem to be consensus in that group on the right answer,

Just to add to this, CTR mode didn't go down with much favour in the
TLS working group either.

There was support from the ADs that an IETF wide solution if it was possible,
was very desirable.

It does seem that TLS is less vulnerable in the ways that it is currently
used than the ways we know that the SSH protocol is currently used.

-- 
Darren J Moffat

---

From: nico <[email-masked]>
Date: Sun, 24 Mar 2002 03:50:09 -0500

Modern Kerberos crypto uses confounders instead of IVs.

Nico