Subject: [TLS] Question for TLS1.2 AEAD cipher

From: Dana Zhao <[email-masked]>
Date: Fri, 6 Jul 2007 11:45:01 -0400

Hi Tim and Eric,

I have some questions in draft-ieft-tls-rfc4346-bis-03.txt, TLS version 
1.2,  6.2.3.3 AEAD ciphers.

1. "opaque IV[SecurityParameters.iv_length]". Is IV encrypted? If so, how 
can the receiver use the IV to decrypt? I guess IV is in plain text, 
right?

2. The additional data for encryption and decryption should be the same. 
While we find that the additional data for encryption contains seq_num and 
the additional data for decryption does not contain seq_num.

3. IV length and Tag length. Is there standard IV length and Tag length? 
If not, when the receiver get the message, how does he know which part is 
IV and which part is aead_output? Also, the receiver needs to know the tag 
length for decryption.

4. On page 22, "Note that in many cases it is appropriate to use the 
partially implicit nonce technique of S 3.2.1 of AEAD", there is not such 
section 3.2.1 in Authenticated Encryption draft-mcgrew-auth-enc-00.txt.

5. How to choose the IV? Is IV of the following format?
    |--- client(server)_write_iv-----|------counter----------|

Thank you very much!

Dana

_______________________________________________
TLS mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/tls

---

From: Eric Rescorla <[email-masked]>
Date: Sat, 07 Jul 2007 16:14:13 -0700

At Fri, 6 Jul 2007 11:45:01 -0400,
> can the receiver use the IV to decrypt? I guess IV is in plain text, 

Yes.

> the additional data for decryption does not contain seq_num.

I don't see that in the text.

> IV and which part is aead_output? Also, the receiver needs to know the tag 

It's defined by the cipher suite.

> section 3.2.1 in Authenticated Encryption draft-mcgrew-auth-enc-00.txt.

You need version -02.

-Ekr

---

From: Dana Zhao <[email-masked]>
Date: Mon, 9 Jul 2007 11:37:15 -0400

Hi Eric,

Thank you very much for your quick response.

>I don't see that in the text.

It is on page 23, draft-ietf-tls-rfc4346-bis-03.txt or 
draft-ietf-tls-rfc4346-bis-04.txt.

 additional_data = seq_num + TLSCompressed.type +
                        TLSCompressed.version + TLSCompressed.length;
 AEADEncrypted = AEAD-Encrypt(key, IV, plaintext,
                      additional_data)
 
 TLSCompressed.fragment = AEAD-Decrypt(write_key, IV, AEADEncrypted,
                   TLSCiphertext.type + TLSCiphertext.version +
                   TLSCiphertext.length);

>It's defined by the cipher suite.

For example, cipher suite "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", GCM 
allows Tag length from 8 to 16 bytes, IV length from 1 to 2^64 bytes(the 
recommended IV length is 12 bytes). What Tag length and IV length should 
we choose? The recommended length?

Thank you.

Dana