)]}'
{
  "commit": "35a1abdbf85f8b74978da3c7feb7bbc9d21caed0",
  "tree": "ea8a14a600bcf5c336808db01891e8eaf68368df",
  "parents": [
    "84af36a21bcec290763da89361af4ae059509405"
  ],
  "author": {
    "name": "Michael Brown",
    "email": "mcb30@ipxe.org",
    "time": "Mon Sep 14 12:33:57 2026 +0100"
  },
  "committer": {
    "name": "Michael Brown",
    "email": "mcb30@ipxe.org",
    "time": "Mon Sep 14 13:55:08 2026 +0100"
  },
  "message": "[tls] Allow for sequential cipher initialisation vectors\n\nThe CBC ciphers require a fully unpredictable initialisation vector,\nwhich we currently generate as a channel ephemeral secret.  The GCM\nciphers require only a unique initialisation vector: there is no\nrequirement for it also to be unpredictable.  The content of the\nrecord IV portion of the IV is a free choice of the sender, and we\ncurrently use an unpredictable value for both CBC and GCM.\n\nTLS version 1.3 removes the record IV portion for GCM ciphers, instead\nconstructing the IV by XORing the sequence number into the end of the\nfixed IV.\n\nDefine the concept of a sequential initialisation vector as meaning\nthat the sequence number is XORed into the end of the overall\ninitialisation vector (which may be either the fixed IV or the record\nIV portion), with no per-record unpredictable value required.  This\nallows us to represent the mechanism required for TLS version 1.3, and\navoid the unnecessary cost of generating a channel ephemeral secret\nfor a GCM cipher under TLS version 1.2.\n\nOn the receive side, the XORed portion may be overwritten by the real\nrecord IV, since the sender\u0027s choice is always definitive for the\ncontents of the record IV.\n\nSigned-off-by: Michael Brown \u003cmcb30@ipxe.org\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "67df84d27c344136cdfd498f12599b324f0694a7",
      "old_mode": 33188,
      "old_path": "src/crypto/mishmash/aes_gcm_sha256.c",
      "new_id": "57868cd41c9eead051bd54671e6495294b676baa",
      "new_mode": 33188,
      "new_path": "src/crypto/mishmash/aes_gcm_sha256.c"
    },
    {
      "type": "modify",
      "old_id": "f3b0601e0f6a39717bdab9142623297a8c69ac4f",
      "old_mode": 33188,
      "old_path": "src/crypto/mishmash/aes_gcm_sha384.c",
      "new_id": "d7196ba88563d4f200bbb0a1d202b095ab790598",
      "new_mode": 33188,
      "new_path": "src/crypto/mishmash/aes_gcm_sha384.c"
    },
    {
      "type": "modify",
      "old_id": "ec21550013aa780ca584c21404c6f44705c14616",
      "old_mode": 33188,
      "old_path": "src/crypto/mishmash/dhe_rsa_aes_cbc_sha1.c",
      "new_id": "8ae747d8127395d1877d7e7ff17e6204a64a9fc7",
      "new_mode": 33188,
      "new_path": "src/crypto/mishmash/dhe_rsa_aes_cbc_sha1.c"
    },
    {
      "type": "modify",
      "old_id": "4e6226e872af605c254166b80f213b281418d596",
      "old_mode": 33188,
      "old_path": "src/crypto/mishmash/dhe_rsa_aes_cbc_sha256.c",
      "new_id": "4358352edf301de47a332fe8c7c350fdd3d586c6",
      "new_mode": 33188,
      "new_path": "src/crypto/mishmash/dhe_rsa_aes_cbc_sha256.c"
    },
    {
      "type": "modify",
      "old_id": "ccf1aeb4b2dfe57fe4d1618ff0a4cc7ecdd1b626",
      "old_mode": 33188,
      "old_path": "src/crypto/mishmash/dhe_rsa_aes_gcm_sha256.c",
      "new_id": "7a640e8b85ea861bfa74e2f0570450b2b31cbabb",
      "new_mode": 33188,
      "new_path": "src/crypto/mishmash/dhe_rsa_aes_gcm_sha256.c"
    },
    {
      "type": "modify",
      "old_id": "668cb2091ad72293615cc7b54b375f30cfd5e238",
      "old_mode": 33188,
      "old_path": "src/crypto/mishmash/dhe_rsa_aes_gcm_sha384.c",
      "new_id": "9ec151e33d3803db5231c7fc0e77d9a48dc4ed27",
      "new_mode": 33188,
      "new_path": "src/crypto/mishmash/dhe_rsa_aes_gcm_sha384.c"
    },
    {
      "type": "modify",
      "old_id": "0d9fcd15d8aea7cc915d234114811a71e3cdc178",
      "old_mode": 33188,
      "old_path": "src/crypto/mishmash/ecdhe_ecdsa_aes_cbc_sha1.c",
      "new_id": "81826a4484c5bb026ddfb6a107ed3607e6d78190",
      "new_mode": 33188,
      "new_path": "src/crypto/mishmash/ecdhe_ecdsa_aes_cbc_sha1.c"
    },
    {
      "type": "modify",
      "old_id": "4b7cf16209772c21dd40554b780f6f2ab13b3ad8",
      "old_mode": 33188,
      "old_path": "src/crypto/mishmash/ecdhe_ecdsa_aes_cbc_sha256.c",
      "new_id": "ecb2e5dc28908671dc6829f409a3d23d0fd56957",
      "new_mode": 33188,
      "new_path": "src/crypto/mishmash/ecdhe_ecdsa_aes_cbc_sha256.c"
    },
    {
      "type": "modify",
      "old_id": "85373911a320e8cc63bafcdcc9bbcc1fd3983ab3",
      "old_mode": 33188,
      "old_path": "src/crypto/mishmash/ecdhe_ecdsa_aes_cbc_sha384.c",
      "new_id": "50aa51d1c066c1ec9d23f84ca06d4d23a6289074",
      "new_mode": 33188,
      "new_path": "src/crypto/mishmash/ecdhe_ecdsa_aes_cbc_sha384.c"
    },
    {
      "type": "modify",
      "old_id": "52a9ac3e1a616564f723aff86d1a9568fd4e1670",
      "old_mode": 33188,
      "old_path": "src/crypto/mishmash/ecdhe_ecdsa_aes_gcm_sha256.c",
      "new_id": "ebfca3c8c46485e17a7b6881770782358c3032a0",
      "new_mode": 33188,
      "new_path": "src/crypto/mishmash/ecdhe_ecdsa_aes_gcm_sha256.c"
    },
    {
      "type": "modify",
      "old_id": "0dab95a606517167c675071fc329deb5608ac001",
      "old_mode": 33188,
      "old_path": "src/crypto/mishmash/ecdhe_ecdsa_aes_gcm_sha384.c",
      "new_id": "18c9275f76f582243808ee4179a642ab45f71147",
      "new_mode": 33188,
      "new_path": "src/crypto/mishmash/ecdhe_ecdsa_aes_gcm_sha384.c"
    },
    {
      "type": "modify",
      "old_id": "46b42ac1ebff666939b6bb21b2b123fd603bc25f",
      "old_mode": 33188,
      "old_path": "src/crypto/mishmash/ecdhe_rsa_aes_cbc_sha1.c",
      "new_id": "22409716862150cdef197743b34e31e772245507",
      "new_mode": 33188,
      "new_path": "src/crypto/mishmash/ecdhe_rsa_aes_cbc_sha1.c"
    },
    {
      "type": "modify",
      "old_id": "dd524ec78122164962fba7df4a8e1c9bb8358b5b",
      "old_mode": 33188,
      "old_path": "src/crypto/mishmash/ecdhe_rsa_aes_cbc_sha256.c",
      "new_id": "93ada644e6e213ce9d49ae9ed3f482ed41b50145",
      "new_mode": 33188,
      "new_path": "src/crypto/mishmash/ecdhe_rsa_aes_cbc_sha256.c"
    },
    {
      "type": "modify",
      "old_id": "7524d1ccc0b41f20703615f627f81a44012f93b5",
      "old_mode": 33188,
      "old_path": "src/crypto/mishmash/ecdhe_rsa_aes_cbc_sha384.c",
      "new_id": "166ae73b014d094302264f3f8ac84c0504fe08df",
      "new_mode": 33188,
      "new_path": "src/crypto/mishmash/ecdhe_rsa_aes_cbc_sha384.c"
    },
    {
      "type": "modify",
      "old_id": "8e0964b0cdc8272cc28e55e3dab60474e3a72998",
      "old_mode": 33188,
      "old_path": "src/crypto/mishmash/ecdhe_rsa_aes_gcm_sha256.c",
      "new_id": "785670bccbb28c96e46fdff647be499c1543f238",
      "new_mode": 33188,
      "new_path": "src/crypto/mishmash/ecdhe_rsa_aes_gcm_sha256.c"
    },
    {
      "type": "modify",
      "old_id": "5b8aace1b1524dafced4b6a3e4aacb646d11b56b",
      "old_mode": 33188,
      "old_path": "src/crypto/mishmash/ecdhe_rsa_aes_gcm_sha384.c",
      "new_id": "d6da45c81a5ff2a40b31cdef22818dbb06135766",
      "new_mode": 33188,
      "new_path": "src/crypto/mishmash/ecdhe_rsa_aes_gcm_sha384.c"
    },
    {
      "type": "modify",
      "old_id": "35f5f6eb7ea7e0ae984fff61b43ff4c7f8009bac",
      "old_mode": 33188,
      "old_path": "src/crypto/mishmash/rsa_aes_cbc_sha1.c",
      "new_id": "17ca9c2f72209d3dada3957a886ba6b7a6a80c88",
      "new_mode": 33188,
      "new_path": "src/crypto/mishmash/rsa_aes_cbc_sha1.c"
    },
    {
      "type": "modify",
      "old_id": "22705df7ef775e532078d0b06055af98d053e578",
      "old_mode": 33188,
      "old_path": "src/crypto/mishmash/rsa_aes_cbc_sha256.c",
      "new_id": "f02dd2fd827ccb6697375e5196cffe51707b09ff",
      "new_mode": 33188,
      "new_path": "src/crypto/mishmash/rsa_aes_cbc_sha256.c"
    },
    {
      "type": "modify",
      "old_id": "5bc08e43ae930c4c5d8958b7a9f6154bfda33a1b",
      "old_mode": 33188,
      "old_path": "src/crypto/mishmash/rsa_aes_gcm_sha256.c",
      "new_id": "ac687b7cc2d5df070f753448cc2cda519e659687",
      "new_mode": 33188,
      "new_path": "src/crypto/mishmash/rsa_aes_gcm_sha256.c"
    },
    {
      "type": "modify",
      "old_id": "305ab7b85c2edfea12ac93c371692b9ddb80a706",
      "old_mode": 33188,
      "old_path": "src/crypto/mishmash/rsa_aes_gcm_sha384.c",
      "new_id": "c9b88d8c40c30538902ef5f237f537c5de79cf3d",
      "new_mode": 33188,
      "new_path": "src/crypto/mishmash/rsa_aes_gcm_sha384.c"
    },
    {
      "type": "modify",
      "old_id": "e882c467e2a347213ae547cbf012657f56db68fb",
      "old_mode": 33188,
      "old_path": "src/include/ipxe/tls.h",
      "new_id": "f36b60ed6678e3a7b69abd244c9a655689c3eb01",
      "new_mode": 33188,
      "new_path": "src/include/ipxe/tls.h"
    },
    {
      "type": "modify",
      "old_id": "129de160ffa44bca0ed23760a481e0b903b6cced",
      "old_mode": 33188,
      "old_path": "src/net/tls.c",
      "new_id": "a57323bd023dbd11c43b9662288ef6888f28edc8",
      "new_mode": 33188,
      "new_path": "src/net/tls.c"
    }
  ]
}