1818235 - DTLS1.3 Modification of the IV generation function

Status: RESOLVED FIXED

(NSS :: Libraries, defect, P4)

Description

[Anna Weine]

It seems that there is a difference between the AEAD Nonce generation (https://searchfox.org/mozilla-central/source/security/nss/lib/ssl/tls13con.c#5671).

Let's call the extracted nonce as IV, and the buffer to randomize it - Nonce.
For WolfSSL implementation the nonce is presented as a sequence number, for us it includes epoch etc.
See RFC 8446: 5.3. Per-Record Nonce

Found during the interoperability testing with WolfSSL.

Comment 1

[Anna Weine]

Attachment: Bug 1818235 - DTLS1.3 Nonce consists only of a sequence number

Comment 2

[Anna Weine]

Actually, the required modifications seem to be more complicated than I expected:
it seems that we need to check for the epoch as well :

 ivOffset = tls13_SetupAeadIv(IS_DTLS_1_OR_12(ss) || cwSpec->epoch == 1, ivOut, cwSpec->keyMaterial.iv,
                                     ivOffset, ivLen, cwSpec->epoch);

and update the nonce offset for the DTLS1.3 case.

Comment 3

[BugBot [:suhaib / :marco/ :calixte]]

The severity field is not set for this bug.
:beurdouche, could you have a look please?

For more information, please visit auto_nag documentation.

Comment 4

[BugBot [:suhaib / :marco/ :calixte]]

There's a r+ patch which didn't land and no activity in this bug for 2 weeks.
:nkulatova, could you have a look please?
If you still have some work to do, you can add an action "Plan Changes" in Phabricator.
For more information, please visit auto_nag documentation.

Comment 5

[Anna Weine]

We plan to land all the DTLS1.3 bugs at once.

Comment 6

[Anna Weine]

https://hg.mozilla.org/projects/nss/rev/958f893c8c884c4204e6655c07660ceef6a44c63