Subject: Re: IV carry

From: Ken Raeburn <[email-masked]>
Date: Wed, 17 Sep 2003 12:09:31 -0400

So, I've been looking into this a little more.

I can easily make a security-oriented case for using the next-to-last
output block from encryption as the outgoing IV, namely it's no worse
than "normal" CBC (with padding) because that's what normal CBC would
do.

So far, though, I haven't found much text on the web discussing what
others are doing.  A crypto++ C++ library at www.trolocsis.com appears
at first glance to "do what normal CBC does" in this regard, though I
think it doesn't swap the last two ciphertext blocks in the case where
the last block is complete.  Lots of discussion on applications where
a new IV is selected for every message, so the carry-out IV doesn't
come up; not so much discussion about chaining across messages.

Unless someone's got a good argument for doing it differently, I'll
write it up as using what would be the last block under "normal" CBC,
i.e., using the next to last block in the multiple-block CTS cases and
the one output block in the one-block-or-less case.

Since the crypto draft is in IETF Last Call at the moment, the revised
text there is more urgent.  Here's my proposal:

    encryption function       conf = random string of length c
                              pad = shortest string to bring confounder
                                    and plaintext to a length that's a
                                    multiple of m
                              (C1, newIV) = E(Ke, conf | plaintext | pad,
                                              oldstate.ivec)
                              H1 = HMAC(Ki, conf | plaintext | pad)
                              ciphertext =  C1 | H1[1..h]
                              newstate.ivec = newIV

    decryption function       (C1,H1) = ciphertext
                              (P1, newIV) = D(Ke, C1, oldstate.ivec)
                              if (H1 != HMAC(Ki, P1)[1..h])
                                 report error
                              newstate.ivec = newIV

Comments?

Ken