Subject: [TLS] AEAD cipher suites: why explicit IVs?

From: "Brian Smith" <[email-masked]>
Date: Fri, 27 Aug 2010 01:32:59 -0500

RFC5288 says that for AES-GCM cipher suites, "The nonce_explicit MAY be the
64-bit sequence number."  Why isn't the nonce implicitly the sequence
number, so that it wouldn't need to be sent over the wire? In the AES-GCM
for ESP spec, the spec states that the IV is explicit because packets may be
reordered. But, that's not an issue for TLS or even DTLS.

In the case of the proposed AES-CCM cipher suites, the draft says that the
sequence number is the nonce; there is no option to use something else.
Isn't the explicit nonce completely redundant then? Would the
half-length-authentication-tag versions of the AES-CCM cipher suites be
needed if there was a way to use a fully implicit nonce instead?

Thank you,
Brian

---

From: Juho Vähä-Herttua <[email-masked]>
Date: Fri, 27 Aug 2010 10:05:06 +0300

> reordered. But, that's not an issue for TLS or even DTLS.

I guess the answer with GCM is in the section:

6.2.  Recommendations for Multiple Encryption Processors

Here each encryption processor has its own nonce counter, I guess it's a tradeoff for easier implementation -- for the encryption processors to be able to use implicit nonce counter, TLS is using explicit nonce instead.

> needed if there was a way to use a fully implicit nonce instead?

Reading the current AES-CCM there seems to be no need for an explicit IV and the AES-CCM draft can be easily be modified to use implicit nonce by defining the SecurityParameters.record_iv_length to be 0 octets. Someone could give comments on the validity of implicit nonce though, because it's impossible to change later without breaking compatibility.

Juho