4 ms·
In order to make the AEAD construction suitable for IPSec it looks like the nonce/block counter split needs to be 92/32 rather than 64/64 as I did it.
by agl 13y ago
In order to make the AEAD construction suitable for IPSec it looks like the nonce/block counter split needs to be 92/32 rather than 64/64 as I did it.
- tptacek 13y ago32 bit block count is gross.
- agl 13y agoWhy? A 32-bit block counter allows for 256GB messages. As AEAD messages shouldn't be decrypted in a "streaming" fashion (lest one return unauthenticated plaintext), that seems more than sufficient. (We don't have a good spec for composing AEAD operations for chunking large messages yet, however.)
- tptacek 13y agoYeah, I see why it works in this setting, it's just ugly; it's a parameter that is only really safe for this algorithm and in this service model. You started with 64/64 for a reason. :)