[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: Calling the question: derived vs. explicit IV
Bill Simpson writes:
> Derived has been show to give somewhat stronger protection of the
> first block than explicit. Estimates are from 2**7 to 2**16
> depending on environment.
Ted Ts'o writes:
>>> Not true. We will be using an MAC to protect the packets against
>>> other attacks; this means that your posited attack of being able to
>>> modify the first block is simply not an issue.
Bill:
> Is a MAC required or optional?
Regardless of whether a cryptographic MAC is in use or not, I agree with
Steve Bellovin's earlier comments that a work factor increase from
0 to 65536 is not significant. I don't think it offers any
practical cryptographic reason to prefer a derived (implicit?) IV to
an explicit IV.
The questions about which shipping products and current implementations
support which IV schemes from which documents seem to be much more
important considerations here. I'm not sure how to reconcile all the
conflicting claims I've seen on the list, so I'm sitting on the fence.
-Lewis
References: