From: Herbert Xu Subject: Re: CCM/GCM implementation defect Date: Fri, 24 Apr 2015 13:30:00 +0800 Message-ID: <20150424053000.GA28657@gondor.apana.org.au> References: <20150423032619.GA17648@gondor.apana.org.au> <20150423114533.GI8928@secunet.com> <1429795499.31437.9.camel@martin> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Cc: Steffen Klassert , netdev@vger.kernel.org, "David S. Miller" , Paul Wouters , Linux Crypto Mailing List To: Martin Willi Return-path: Received: from helcar.hengli.com.au ([209.40.204.226]:45747 "EHLO helcar.hengli.com.au" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754260AbbDXFaQ (ORCPT ); Fri, 24 Apr 2015 01:30:16 -0400 Content-Disposition: inline In-Reply-To: <1429795499.31437.9.camel@martin> Sender: linux-crypto-owner@vger.kernel.org List-ID: On Thu, Apr 23, 2015 at 03:24:59PM +0200, Martin Willi wrote: > > Do you have any pointer for me where this is defined? Why is it needed, > given that GCM implicitly authenticates the IV by using it in Y0? Actually you're quite right. Both GCM and CCM implicitly includes the IV in the authentication tag. In fact after reviewing the two relevant RFCs (4106/4309) it seems that we are correct after all since they explicitly exclude the IV from the AAD. Now we just need to figre out whether we're still OK with RFC4543. Sorry for the false alarm. Cheers, -- Email: Herbert Xu Home Page: http://gondor.apana.org.au/~herbert/ PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt