Re: [Cfrg] draft-housley-ccm-mode-00.txt

[Uri Blumenthal <uri@bell-labs.com>]

On Thursday 15 August 2002 15:59, Housley, Russ wrote:
> Greg:
> I understand the conventional wisdom that you are offering.  However,
> authenticated encryption (using a single key) has been an area of
> recent research.  IAPM, OCB, and CCM are approaches.

That conventional wisdom was based on the concept of two
independent algorithms (probably of different strength) - and
on the threat that the failure of the weaker algorithm will
compromise whatever was protected by the stronger
one - when they share the same key.

In this case it's a *combined* algorithm - a "one" thing that
happens to do both encryption and MACing. Thus I don't
think the conventional wisdom applies. In fact, for such
a mode I find it *better* to use a single key.

> Jakob Jonsson from RSA Labs has done a security proof of CCM.  While
> the proceedings are not out yet, his paper was accepted at SAC.  The
> peer reviewer did not find any problems, and I look forward to the
> broader review once the paper is readily available.

I'd like a look at that paper, if possible.

Thanks!

> At 03:52 AM 8/16/2002 +1000, Greg Rose wrote:
> >Doing the authentication and the encryption with the same key is bad
> >practice. You should take the input key, and derive from it two
> >subordinate keys, which are independent of each other as far as an
> > outside attacker can tell, then use one of them for the counter
> > mode encryption, the other for the CBC-MAC.
> >
> >regards,
> >Greg.
> >
> >At 10:55 AM 8/15/2002 -0400, Housley, Russ wrote:
> >>Dear CFRG:
> >>
> >>I would like to draw your attention to this document.  It contains
> >> a specification for an authenticated encryption mode.  It was
> >> designed fro use with AES, but, of course, it will work with any
> >> 128-bit block cipher.
> >>
> >>The authors have submitted it to NIST for consideration as a FIPS
> >>mode.  You can learn more about CCM and the other proposed modes at
> >> the NIST web site ( see
> >> http://csrc.nist.gov/encryption/modes/proposedmodes/ ).
> >>
> >>IEEE 802.11 has chosen to make CCM the mandatory to implement AES
> >> mode for wireless LAN encryption. IEEE 802.15 has also chosen CCM
> >> for use with personal area networks.  In my opinion, this success
> >> is due to the lack of a patent (or pending patent from the
> >> authors) on CCM.  I suspect that most of the members of this list
> >> are aware that other candidate authenticated encryption modes are
> >> encumbered.
> >>
> >>It is my intention to publish draft-housley-ccm-mode-00.txt as an
> >>Informational RFC.  This looks like the appropriate group to review
> >> the document.
> >>
> >>Russ
> >>
> >>_______________________________________________
> >>Cfrg mailing list
> >>Cfrg@ietf.org
> >>https://www1.ietf.org/mailman/listinfo/cfrg
> >
> >Greg Rose                                       INTERNET:
> > ggr@qualcomm.com Qualcomm Australia          VOICE:  +61-2-9817
> > 4188   FAX: +61-2-9817 5199 Level 3, 230 Victoria Road,            
> >    http://people.qualcomm.com/ggr/ Gladesville NSW 2111    232B
> > EC8F 44C6 C853 D68F  E107 E6BF CD2F 1081 A37C
>
> _______________________________________________
> Cfrg mailing list
> Cfrg@ietf.org
> https://www1.ietf.org/mailman/listinfo/cfrg

-- 
Regards,
Uri-David
-=-=-<>-=-=-
<Disclaimer>

_______________________________________________
Cfrg mailing list
Cfrg@ietf.org
https://www1.ietf.org/mailman/listinfo/cfrg