It seems that the nonce of AES-GCM in SSL has 3 parts:
- salt, 4 bytes, generated in handshake, not changed in whole session
- nonce_explicit, 8 bytes, chosen by the sender and carried in each SSL record
- inner_counter, 4 bytes, used in AES-GCM internal
Is it possible to use a more simple method to construct the nonce:
- generate a 16-bytes IV in handshake
- use this IV as counter for each cipher block in the whole session life, ignore SSL record boundary
then the sender need not carry nonce for each record, saving the bandwidth.
I read the RFCs again and found I misunderstood something.
Let me make the question clear.
AES-GCM algorithm: require the nonce is distinct.
AES-GCM specification [RFC 5116]:
It gives an recommended format (not required):
" When there are multiple devices performing encryption using a single key, those devices must coordinate to ensure that the nonces are unique. A simple way to do this is to use a nonce format that contains a field that is distinct for each one of the devices, as described in Section 3.2." [ Fixed + Counter ]
" In some cases, it is desirable to not transmit or store an entire nonce, but instead to reconstruct that value from contextual information immediately prior to decryption." [ Fixed-Common + Fixed-Distinct + Counter ]
It is defined for protocols that uses record. I missed this before:
"Each AEAD algorithm MUST accept any plaintext with a length between zero and P_MAX octets, inclusive, where the value P_MAX is specific to that algorithm. The value of P_MAX MUST be larger than zero, and SHOULD be at least 65,536 (2^16) octets. This size is a typical upper limit for network data packets."
QUESTION: However if we ignore the specification, is it possible to treat the whole SSL session as a stream (ignore the record bondary), and use only one nonce (and use the nonce as counter) ?
AES-GCM in SSL [RFC 5288]: it uses the recommended format.
QUESTION: since it generates master-secret in each SSL session, it would not hanppen that "multiple devices performing encryption using a single key". Why does SSL use the recommended format (the Fixed part)? What's the function of 'salt'?
I know that since specifications of AES-GCM and SSL have been defined, we should just follow it. I just wonder why it was defined like this.
Besides, maybe we could define an SSL-extension, so that the SSL client and server could use record-seq as nonce_explicit, and do not send it with record.