See inline. Look for Praveen.
On Mon, Apr 25, 2016 at 7:20 PM, Brian Smith <br...@briansmith.org> wrote:
> Praveen Kariyanahalli via RT <r...@openssl.org> wrote:
>
>> Is there is a reason why openssl has restriction of auth before encrypt
>> order ? I dont believe there is an algo restriction, was wondering why
>> openssl has this.
>>
>
> It *is* inherent in the algorithm. The authentication tag for the AAD is
> computed first, then the authentication tag for the encrypted data is
> computed.
>
[praveen] From the NIST documentation it is not that clear (SP-800-38D page
15).
Steps: 1. Let H = CIPHK(0128).
2. Define a block, J0, as follows: If len(IV)=96, then let J0 = IV
|| 031 ||1. If len(IV) ≠ 96, then let s = 128 ⎡len(IV)/128⎤-len(IV), and
let J0=GHASHH(IV||0s+64||[len(IV)]64).
* 3. Let C=GCTRK(inc32(J0), P). *
4. Let u = ⋅⎡ ⎤ ( ) C − len128len128 (C) and let v = ⋅⎡ (A) ⎤ −
len128len128 ( ) A .
* 5. Define a block, S, as follows: S = GHASHH (A || 0v || C || 0u ||
[len(A)]64 || [len(C)]64). *
6. Let T ( ) SJ K , 0 ( ). = MSBt GCTR 7. Return (C, T).
Sorry my cut n paste swallowed some characters :). The steps mentioned
itself is NOT the order you mention.
>
>
>> The reason I bring this up, is that when I broadcast/multicast traffic
>> need
>> not encrypt the payload multiple times, but need to auth the header
>> differently and openssl is refusing to cooperate :)
>
>
> With AEADs, in general, you can't separate the authentication from the
> encryption like that.
>
>
[praveen]
I agree, but I was talking about auth only part. For example, in a packet
that need to be replicated, the outer header will change for each
recipient, but the payload will remain same. Was wondering if I can benefit
by skipping the C part for the subsequent copies.
I totally understand for HW implementation it does NOT make sense. But was
curious why this restriction?
Thanks
-Praveen
> Cheers,
> Brian
> --
> https://briansmith.org/
>
>
> --
> openssl-dev mailing list
> To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-dev
>
>
--
-Praveen
--
openssl-dev mailing list
To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-dev
