[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [MSEC] MSEC WGLC on draft-ietf-msec-ipsec-group-counter-modes-02

Hi David,

thanks for the comments, more inline:

On Dec 9, 2008, at 2:30 PM, Black_David at emc.com wrote:


Last week, the authors of this draft asked me to take a look
at it.  I apologize for these comments coming slightly after
WG Last Call ends, and thank the authors in advance for their
patience in waiting for these comments.

Overall, the draft looks good, and I think support for further
use of these modes is a "good thing".  I have a couple of minor
comments:

(1) I would add a sentence to either Section 3 (IV formation)
or section 6 (Security Considerations) to the effect that the
security properties of these modes do not rely upon
unpredictability of the initial IV values (IV sequences for
counter modes tend to be predictable for obvious reasons).
On initial reading, I was concerned about potential SID
use of 2 octets out of an 8-octet IV, and such a sentence
would remove that concern.


Section 2, par 1 ends like this:
"That is, for each key, no IV value can be used more than once. This restriction on IV usage is imposed on ESP CTR, ESP GCM, and ESP CCM. In cryptographic terms, the IV is a nonce."
Right after that, we could add: "(Note that CBC mode requires IVs that are unpredictable. CTR, GCM, GMAC, and CCM do not have these restrictions.)
I'm fine with adding something in Section 3 or 6 too. In Section 3 we could say "Neither the SID nor the SSIV fields need to be unpredictable. The uniqueness requirements described above meet all of the security requirements of CTR, GCM, GMAC, and CCM modes." 

Wordsmithing welcome.




(2) The first two bullet items in Section 4 are not as clear
as they could be:
- It is unclear whether the first requirement applies across
	all SAs, or on an SA by SA basis.


Good point.   I suggest something like"
"For each SA for which sender identifiers are used, the GKMS MUST NOT give the same sender identifier to more than one active group member ... " 



- There is almost no discussion about what happens if the
	SHOULD in the second bullet is not followed.
I think the first requirement is on an SA by SA basis (that
should be stated), and then the explanation of the SHOULD in
the second requirement can be two-fold:
- Avoids need to manage SIDs on a per-SA basis in not only
	the GKMS, but also the senders (the latter is probably
	the more important consideration).
- Avoids any need to change/issue SIDs when rekeying an SA.
Only the latter point appears to be mentioned.



Sounds good to me.

Thanks again!

David


Thanks,
--David
----------------------------------------------------
David L. Black, Distinguished Engineer
EMC Corporation, 176 South St., Hopkinton, MA  01748
+1 (508) 293-7953             FAX: +1 (508) 293-7786
black_david at emc.com        Mobile: +1 (978) 394-7754
----------------------------------------------------




_______________________________________________
MSEC mailing list
MSEC at ietf.org
https://www.ietf.org/mailman/listinfo/msec