Subject: digest-md5 and CBC

From: Sam Hartman <[email-masked]>
Date: Tue, 16 Nov 2004 17:36:59 -0500

Hi.  I'm sorry that this message has been delayed so long.

After IETf 60, Alexey and I (as chair) talked to Russ about
digest-md5's usage of CBC.

As the working group will recall, there are two proposals.  The first
proposal is that an explicit IV be included in every message.  The
second proposal is that there be two blocktypes.  The first includes
an explicit IV and the second includes a CBC block.  No requirement
would be made that every block be proceeded by a CBC block.

There are two advantages the the second proposal.  The first is that
it happens to fit the Cyrus code base better.  The second is that it
can avoid the expansion factor of the IV.  Russ didn't think much of
the first advantage; personally I agree.

My concern with this approach is that I believe it is vulnerable to an
attack where the CBC datastream can be used as an oracle to test
guesses of what previous ciphertext decrypts to.  The attack is
somewhat hard to construct and assumes that an attacker can observe
the generated ciphertext and can inject text to be encrypted directly.
So it is not completely clear that we must address this problem.

Russ instructed me to run the proposal by the CFRG and if they did not
raise strong objections the WG could take that approach if it desired.

The rest of this message is my opinion as an individual participant.

If our goal is the avoid expansion, there is a secure way to do that.
We can use counter mode instead of CBC.  That would make our AES mode
work a lot like our RC4 mode.  You need to be careful when using a
counter-mode cipher, but we already have this complexity for RC4.

We decided against counter mode for complexity reasons.  However if we
need the features of counter mode I'd rather see us take that
approach.

--Sam