Re: [TLS] Re: SIV as WG item?

[Eric Rescorla <ekr@xxxxxxxxxxxxxxxxxxxx>]

At Wed, 16 Jan 2008 09:57:36 -0800 (PST),
Dan Harkins wrote:
> 
> 
>   The GCM ciphersuites for TLS use the deterministic nonce construction.
> You can ignore the other one in SP 800-38D. Just pay attention to the
> sections I listed.
> 
>   Like I said, if you think that GCM cannot be implemented in TLS in
> such a way that it could fall under any of the topics SP 800-38D addresses
> then SIV is not for you.
> 
>   I, on the other hand, doubt that "IT professionals" on whom the security
> of GCM depends (according to SP 800-38D) will understand the nuance around
> IV management. In fact, experience shows that "IT professionals" will
> routinely cut corners with security to make things be more scalable--
> group pre-shared keys anyone? If all you care about when deploying a
> security system is to merely get your boss off your back then the special
> circumstances surrounding the particular module in the system you deploy
> is not of paramount concern.
> 
>   But it's fine. If you think that it is impossible to misuse your GCM
> implementation then bully for you. Do you also think that it is impossible
> to misuse _ANY_ TLS implementation of GCM? Is there something in TLS that
> makes SP 800-38D not apply?

Dan,

As I said in the WG meeting, I think this only meets half the burden for
SIV being a good idea. TLS has a block cipher mode which is extremely
resistant to IV reuse: CBC. The reason that GCM is attractive is that
it has good performance and ciphertext size properties as compared to
CBC. Given that SIV doesn't have particularly good performance propoerties,
in what settings would it be significant improvement over CBC?

-Ekr


_______________________________________________
TLS mailing list
TLS@xxxxxxxxxxxxxx
https://www1.ietf.org/mailman/listinfo/tls