RSA-AES-SIV TLS Ciphersuites Dan Harkins

RSA-AES-SIV Ciphersuites What is being proposed? –New ciphersuites for TLS using SIV mode of authenticated encryption. –RSA key exchange and Diffie-Hellman key exchange both with RSA authentication and SIV using two different key sizes  Four new ciphersuites. –Draft modeled closely on draft-ietf-tls-rsa-aes-gcm but minus some of the verbage on nonce management.

RSA-AES-SIV Ciphersuites Why is it being proposed? –Unlike other authenticated encryption modes SIV is resistant to nonce misuse. –Uniquely suited when nonce management is outside the cryptographic engine– e.g. when applications receive TLS services via an API to a library. –For control-plane (versus data plane) applications where a two-pass mode is not onerous and where resistance to unintentional programming errors, misconfiguration, and intentional misuse are needed, e.g. CAPWAP’s control channel.

What is SIV? An Authenticated Encryption with Associated Data (AEAD) cipher mode. Uses AES in CTR mode and CMAC mode. PRF construction takes a vector of associated data (plus plaintext), a component in that vector is the nonce. If a nonce is reused authenticity is retained and confidentiality is affected only to the extent that an adversary knows the same nonce was used with the same plaintext and key twice. Provable security!

SIV Encrypt SIV Decrypt AD1ADn S2V-CMAC P CTR … IVC AD1ADn S2V-CMAC P CTR … IVC IV’ FAIL != Associated Data Plaintext Ciphertext From “Deterministic Authenticated Encryption” by Phil Rogaway and Thomas Shrimpton

Free Code! % cd openssl-x-y-z % tar xzvf siv_for_openssl.tgz crypto/aes/Makefile crypto/aes/aes_siv.c crypto/aes/siv.h % make clean; make

References “Deterministic Authenticated Encryption, A Provable-Security Treatment of the Key- Wrap Problem”– Phil Rogaway and Thomas Shrimpton, from Advances in Cryptology EUROCRYPT ’06. draft-harkins-tls-rsa-siv-00.txt draft-dharkins-siv-aes-01.txt draft-ietf-tls-rsa-aes-gcm-00.txt