SSL 3.0 and TLS 1.0 used an insecure scheme to generate implicit IVs when encrypting records in CBC mode: They used the last part of the previous record, a value that can be predicted by the attacker. This attack was demonstrated in the BEAST attack.
To avoid these issues, TLS 1.1 and later use explicit IVs, which are sent as part of the record. This avoids the attack, but also adds a 16 byte overhead to each record.
[CBCATT] describes a chosen plaintext attack on TLS that depends on knowing the IV for a record. Previous versions of TLS [TLS1.0] used the CBC residue of the previous record as the IV and therefore enabled this attack. This version uses an explicit IV in order to protect against this attack.
My first idea to fix this problem wouldn't have been explicit IVs, but rather implicit IVs that get derived securely a shared secret. TLS already defines schemes to generate arbitrary length pseudo-random data from the master secret (see 5. HMAC and the Pseudorandom Function).
Why did the designers of TLS 1.1 decide to go with explicit IVs, instead of simply replacing the weak implicit IV scheme with a strong one? Do explicit IVs offer any advantage over well generated implicit IVs?
