crypto/cipher: NewGCMWithNonceSize allows zero-length nonce

[katiehockman]

cipher.NewGCMWithNonceSize allows for any nonce size, including one that is zero length. This is not allowed by NIST SP 800-38D and encrypting with such an IV leaks the authentication key.

NIST SP 800-38D:

The bit lengths of the input strings to the authenticated encryption function shall meet the
following requirements:
...
1 ≤ len(IV) ≤ 264-1

Allowing a zero-length nonce opens the package up to misuse, and there is never a valid reason to do this. It could be argued that cipher.NewGCMWithNonceSize isn't meant to be as safe, and the recommended approach is to use cipher.NewGCM, however this is a hardening measure that has no negative side effects, in my opinion.

cipher.NewGCMWithNonceSize docs:

Only use this function if you require compatibility with an existing cryptosystem that uses non-standard nonce lengths. All other users should use NewGCM, which is faster and more resistant to misuse.

/cc @FiloSottile

[katiehockman]

@FiloSottile suggested that we backport this fix as well.

[gopherbot]

Change https://golang.org/cl/218500 mentions this issue: crypto/cipher: require non-zero nonce size for NewGCMWithNonceSize

[networkimprov]

@gopherbot please open backport, at suggestion of @FiloSottile.

[gopherbot]

Backport issue(s) opened: #37416 (for 1.14), #37417 (for 1.13), #37418 (for 1.12).

Remember to create the cherry-pick CL(s) as soon as the patch is submitted to master, according to https://golang.org/wiki/MinorReleases.

[networkimprov]

@dmitshur, also needs 1.14 backport...

[dmitshur]

I'll repurpose the 1.12 one. It won't be getting this backport because 1.14 will be out by then, so it'll be too old.

[networkimprov]

Backport issue for 1.12 is now #37418

[gopherbot]

Change https://golang.org/cl/220651 mentions this issue: [release-branch.go1.14] crypto/cipher: require non-zero nonce size for AES-GCM

[gopherbot]

Change https://golang.org/cl/220653 mentions this issue: [release-branch.go1.13] crypto/cipher: require non-zero nonce size for AES-GCM

[dmitshur]

/cc @dunhamsteve FYI.