Subject: Re: [TLS] Consensus for AEAD IV

From: Eric Rescorla <[email-masked]>
Date: Sun, 17 May 2015 06:27:43 -0700

The following PR makes this change:
https://github.com/tlswg/tls13-spec/pull/155

Target merge date: 5/20

Note 1: I haven't done anything about changing derivation one way or the
other. These are orthogonal issues.

Note 2: Should the ChaCha draft adopt this change as well, since it's
already incompatible with the encoding TLS 1.2 uses for GCM?

-Ekr

On Fri, Apr 24, 2015 at 10:10 AM, Joseph Salowey <[email-masked]> wrote:

> The general consensus on the list seems to prefer to derive "IV" and use
> it to make the AEAD nonce less predictable. Most folks seemed to be OK with
> this approach.    In Dallas, there was significant support for using the
> derived "IV" as a per session XOR mask for the counter.  If you have
> objections to this approach please respond on the list by May 1, 2015 .
>
> Cheers,
>
> Joe
>
> _______________________________________________
> TLS mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/tls
>
>

---

From: Yoav Nir <[email-masked]>
Date: Sun, 17 May 2015 16:41:44 +0300

> On May 17, 2015, at 4:27 PM, Eric Rescorla <[email-masked]> wrote:

<snip />

> already incompatible with the encoding TLS 1.2 uses for GCM?

IMO ChaCha should do the same as GCM in TLS 1.2, and do the new thing in TLS 1.3.  ChaCha20-Poly1305 has experimental running code and should be ready and deployable far earlier than TLS 1.3.  

IOW ChaCha should do like GCM in both versions.

Yoav

---

From: Nikos Mavrogiannopoulos <[email-masked]>
Date: Mon, 18 May 2015 10:15:04 +0200

> IOW ChaCha should do like GCM in both versions.

I concur with that. It makes a very complex protocol otherwise.