On Sun, May 15, 2016 at 11:43 AM, Rick van Rein <[email protected]> wrote:
> Hi, > > > I think the erratum needs an erratum. Firstly, "nonce" doesn't mean > "number > > used once", and secondly nonce re-use in AES-GCM doesn't just result in > > "catastrophic failure of it's authenticity", it results in catastrophic > > failure of the entire mode, both confidentiality and > integrity/authenticity. > > I'd like to add that I don't see a difference between a "failure" and a > "catastrophic failure". It's probably better to stay away from subjective > words like that. > > [Joe] It would be better to state what actually fails: "Nonce re-use in AES-GCM allows for the recovery of the authentication key resulting in complete failure of the mode's authenticity. Hence, TLS sessions can be effectively attacked through forgery by an adversary. This enables an attacker to inject data into the TLS allowing for XSS and other attack vectors. " > -Rick >
_______________________________________________ TLS mailing list [email protected] https://www.ietf.org/mailman/listinfo/tls
