Subject: Re: [TLS] questions regarding draft-ietf-tls-rfc2246-bis-13.txt

From: Eric Rescorla <[email-masked]>
Date: Mon, 06 Feb 2006 11:04:25 -0800

Sami Lehtinen <[email-masked]> writes:

> Hello,
>
> In section 6.2.3.2. CBC block cipher:
>
>     The encrypted data length (TLSCiphertext.length) is one more than the
>     sum of TLSCompressed.length, CipherSpec.hash_size, and
>     padding_length.
>
> Should this be:
>
>     The encrypted data length (TLSCiphertext.length) is one more than the
>     sum of CipherSpec.block_length, TLSCompressed.length,
>            ^^^^^^^^^^^^^^^^^^^^^^^^^
>     CipherSpec.hash_size, and padding_length.
>
> to accommondate for the explicit IV?

I've reviewed this and I believe this is incorrect. You can form the
explicit IV by encrypting a non-explicit IV, but it's not properly
part of the ciphertext.

Best,
-Ekr

_______________________________________________
TLS mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/tls

---

From: Sami Lehtinen <[email-masked]>
Date: Mon, 13 Feb 2006 10:03:15 +0200

> explicit IV by encrypting a non-explicit IV, but it's not properly

So, in your opinion the explicit IV length is _not_ added to the 
TLSCiphertext.length?

Record layer implementation thus needs to take into account that we are 
running TLS1.1, have a block cipher (=> explicit IVs) and add 
CipherSpec.block_length (size of IV) to received record layer length 
when reading the record?

 From draft-ietf-tls-rfc2246-bis-13.txt:

        struct {
            ContentType type;
            ProtocolVersion version;
            uint16 length;
            select (CipherSpec.cipher_type) {
                case stream: GenericStreamCipher;
                case block: GenericBlockCipher;
            } fragment;
        } TLSCiphertext;

    [...]

    length
        The length (in bytes) of the following TLSCiphertext.fragment.
        The length may not exceed 2^14 + 2048.

and fragment is:

        block-ciphered struct {
            opaque IV[CipherSpec.block_length];
            opaque content[TLSCompressed.length];
            opaque MAC[CipherSpec.hash_size];
            uint8 padding[GenericBlockCipher.padding_length];
            uint8 padding_length;
        } GenericBlockCipher;

To me, `length' specification above reads as "length = 
sizeof(GenericBlockCipher)", which would include the size of the IV.

-- 
[email-masked]