Subject: RE: [TLS] NIST TLS recomendations (IV generation)

From: "Blumenthal, Uri" <[email-masked]>
Date: Tue, 21 Nov 2006 11:12:03 -0500

Pasi,

For the 1st statement how about:

	The IV SHOULD be chosen at random, and MUST be 
	unique and unpredictable. 

(based on crypto wisdom :-)

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] 
Sent: Tuesday, November 21, 2006 10:37 AM
To: [email-masked]; [email-masked]
Subject: RE: [TLS] NIST TLS recomendations (IV generation)

Ray Perlner wrote:
> Page 20-21: Section 6.2.3.2 under IV The document specifies that the
> IV SHOULD be generated by method (1) or (2) and MAY be generated by
> an alternate method. There is, however, no language forbidding the
> generation of IVs by a fourth unlisted method. If a fourth method is
> used, the protocol will not fail but may be insecure. Therefore we
> recommend adding language forbidding the use of an unlisted method
> for IV generation.

Actually the whole text about IVs is quite long, and contains
implementation details that IMHO are likely to confuse rather than
help an implementer.

How about just replacing the whole text about IVs with something
like this?

   IV

       The Initialization Vector (IV) MUST be chosen at random, and
       MUST be unpredictable. See [SP800-38A] Appendix C for
       RECOMMENDED methods for generating unpredictable IVs.

       It is critical that the IV is not sent before the entire
       plaintext of the record is known; otherwise it is possible for
       the attacker to mount the attack described in [CBCATT].

       Note: In versions of TLS prior to 1.1, there was no IV field,
       and the last ciphertext block of the previous record (the "CBC
       residue") was used as the IV. This was changed to prevent the
       attacks described in [CBCATT].

Best regards,
Pasi

_______________________________________________
TLS mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/tls

_______________________________________________
TLS mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/tls

---

From: <[email-masked]>
Date: Tue, 21 Nov 2006 18:34:19 +0200

Uri,

I'd like to align the text with NIST SP 800-38A, which doesn't 
require uniqueness for CBC mode (and for other modes where 
uniqueness is required, generating the IV randomly is not 
usually acceptable).

So how about "The Initialization Vector (IV) SHOULD be 
chosen at random, and MUST be unpredictable" ?

(This text is in section titled "CBC block cipher",
so no need to consider OFB or CTR here...)

Best regards,
Pasi

> From: ext Blumenthal, Uri [mailto:[email-masked]] 
> Sent: 21 November, 2006 18:12
> To: Eronen Pasi (Nokia-NRC/Helsinki); [email-masked]; 
> [email-masked]