Authenticated cipher modes

[Henrick Hellström <henrick%streamsec.se@localhost>]

While trying to figure out how to support CCM, EAX and OCB cipher modes 
or the Helix cipher (http://www.schneier.com/paper-helix.pdf), I spotted 
an issue with SSH-TRANS. These cipher modes have built in data 
integrity, but the SSH-TRANS algorithm negotiation mechanism clearly 
isn't designed to handle such encryption.

There are three reasons such encryption algorithms should be supported:
1. Performance. They are twice as fast since the encryption mode 
provides data integrity by itself.
2. Resources. Helix in particular consumes very little resources. There 
are no memory consuming s-boxes and the algorithm might be implemented 
to hold the entire state in CPU registers (at least on CPUs such as 
AMD64/EM64T and M680x0 that have a relatively high number of general 
purpose registers).
3. Security. According to http://cr.yp.to/papers.html#cachetiming, 
encryption algorithms that use sboxes are vulnerable to timing attacks, 
and fixed time algorithms such as Helix should be used for online 
transport encryption.

Here is the problem:

Suppose I define an encryption I name "helix%streamsec.com@localhost". I would 
then want the following:

1. If the server and the client negotiate this encryption, they MUST 
also negotiate a designated data integrity name, which is specified to 
be coupled with the encryption in question. There is no point in adding 
a second layer of data integrity to e.g. Helix encryption. This is 
unfortunately not consistent with the algorithm selection mechanism 
specified in section 7.1 of SSH-TRANS. If the standard algorithm 
selection mechanism is followed, the client and the server might end up 
with e.g. helix%streamsec.com@localhost for encryption and an unrelated data 
integrity algorithm. For example, this would happen if the client is 
sending "rijndael128-ocb%streamsec.com@localhost,helix%streamsec.com@localhost,3des-cbc" for 
encryption and "hmac-sha1,helix%streamsec.com@localhost" for data integrity, and 
the server is sending 
"twofish128-ocb%streamsec.com@localhost,helix%streamsec.com@localhost,3des-cbc" for 
encryption and "hmac-sha1,helix%streamsec.com@localhost" for data integrity.

2. The processing rules of section 6.4 "Data integrity" of SSH-TRANS 
MUST be integrated into the encryption processing, if e.g. Helix 
encryption is selected. That is, the message counter should be processed 
by the encryption as unencrypted header data, in accordance with the 
Helix specification. (One should note that CCM mode is less of an issue 
in this respect, since an implicit message counter is part of the mode 
itself. Selecting CCM mode and the "none" data integrity algorithm would 
result in the desired state.)

--
Henrick Hellström
www.streamsec.com