Allow nonce reuse

[erenon]

Problem:

Use-case: on a signal, I want to send A xor B message immediately. To save on the TLS encryption, I want to encrypt both messages beforehand, with the same nonce. crypto/fipsmodule/cipher/e_aes.c prevents this.

Solution:

In crypto/fipsmodule/cipher/e_aes.c, remove the given_counter < gcm_ctx->min_next_nonce check. (the min_next_nonce field can be removed compleltey)

The change is trivial, but I do not understand why the check is there on the first place. To protect the user against accidental misuse? I can prepare an MR.

• Does this change any public APIs?

No

• Which algorithm(s) will this impact?

AES

[torben-hansen]

Hi,

It's not entirely clear to me what you are trying to achieve and how you are trying to achieve it (e.g. you using libssl?).

FWIW, encrypting two messages A and B with the same AES-GCM pair (key, IV/nonce) violates AES-GCM's usage requirements and voids its security controls. The EVP_AEAD TLS-specific implementations restricts usage in line with TLS specifications; we have no plans to change that.

In case you are not using libssl:
You can use these EVP_EAD implementations that doesn't have that codified requirements: https://github.com/aws/aws-lc/blob/main/include/openssl/aead.h#L82-L111.

[erenon]

Thanks for the quick reply!

I'm using rustls -> aws-lc-rs -> aws-lc.

encrypting two messages A and B with the same AES-GCM pair (key, IV/nonce) violates AES-GCM's usage requirements and voids its security controls

I'm encrypting two messages A and B with the same AES-GCM pair, but I'm sending out at most one, the other one is discarded. Is there still a security risk?

I'll need to check if using a different EAD is possible/feasible, that doesn't have this extra check.

[aromal-a]

Gtx -> san.h : Driven :: Main(log [arithmetic (met + )])
Sans.h <F.driver()>. => [pashe.in/Perm]

Menu.At[ Turn: steel : metal , Meet : XRPXOR] , Met @ Triumph : Local@Base , Inference @ system's level. Fraction Integration , Decimal different , allow —rename : <Solemn : update()>