Subject: [TLS] Fixing CBC Mode I: GenericBlockCipher construction

From: Eric Rescorla <[email-masked]>
Date: Sun, 29 Dec 2013 15:15:47 -0800

We have seen two major proposals for fixing the GenericBlockCipher
construction:

- Encrypt-then-MAC
- Pad-MAC-Encrypt

The sense of the chairs is that the Encrypt-then-MAC construction
has greater support (see, for instance, the thread started by
http://www.ietf.org/mail-archive/web/tls/current/msg10584.html)
but we would like to confirm that impression.

If you have a comment to make about this, please do so by
January 10, 2014.

-Ekr
[For the Chairs]

---

From: Alyssa Rowan <[email-masked]>
Date: Mon, 30 Dec 2013 00:03:38 +0000

> - Encrypt-then-MAC

I prefer Encrypt-then-MAC: it's the least fragile.

- -- 
/akr

---

From: Adam Langley <[email-masked]>
Date: Sun, 29 Dec 2013 19:31:56 -0500

> We have seen two major proposals for fixing the GenericBlockCipher

I favor Encrypt-then-MAC.

(Would the new construction include a per-record IV in TLS 1.0?)

Cheers

AGL

-- 
Adam Langley [email-masked] http://www.imperialviolet.org

---

From: Eric Rescorla <[email-masked]>
Date: Sun, 29 Dec 2013 16:58:19 -0800

> (Would the new construction include a per-record IV in TLS 1.0?)

Peter's current draft does not include this change.

Speaking for myself I would prefer we not do so, since that's
already in TLS 1.1 and TLS 1.2 and so we should be focusing
here on the minimal change.

-Ekr

---

From: Yoav Nir <[email-masked]>
Date: Mon, 30 Dec 2013 09:35:20 +0000

> We have seen two major proposals for fixing the GenericBlockCipher

I prefer Encrypt-then-MAC  (or rather Pad-Encrypt-Mac)

This has been used in IPsec for as long as there's been IPsec, and has not been broken. 

It has the desirable property that spoofed or modified packets can be detected more quickly, as only the MAC function needs to be run for such detection. With P-M-E the receiver has to decrypt and calculate the MAC to identify a modified packet. This does mean that we should be careful with the MAC functions that they don't leak information through side channel, but that is a property that we require of MAC functions anyway.

Yoav

---

From: Yoav Nir <[email-masked]>
Date: Mon, 30 Dec 2013 09:37:27 +0000

> (Would the new construction include a per-record IV in TLS 1.0?)

If you do that, I think you pretty much have TLS 1.1.

So no, I think any implementation that adds this should also have TLS 1.1. No, they should add TLS 1.1 even if they don't (yet) implement this.

Yoav

---

From: Tom Ritter <[email-masked]>
Date: Mon, 30 Dec 2013 10:54:45 -0500

-tom