-----Original Message-----
From: David McGrew [mailto:mcgrew at cisco.com]
Sent: Friday, December 12, 2008 1:32 PM
To: Black, David
Cc: msec at ietf.org; bew at cisco.com; ldondeti at qualcomm.com
Subject: Re: MSEC WGLC on draft-ietf-msec-ipsec-group-counter-modes-02
Hi David,
thanks for the comments, more inline:
On Dec 9, 2008, at 2:30 PM, Black_David at emc.com wrote:
Last week, the authors of this draft asked me to take a look
at it. I apologize for these comments coming slightly after
WG Last Call ends, and thank the authors in advance for their
patience in waiting for these comments.
Overall, the draft looks good, and I think support for further
use of these modes is a "good thing". I have a couple of minor
comments:
(1) I would add a sentence to either Section 3 (IV formation)
or section 6 (Security Considerations) to the effect that the
security properties of these modes do not rely upon
unpredictability of the initial IV values (IV sequences for
counter modes tend to be predictable for obvious reasons).
On initial reading, I was concerned about potential SID
use of 2 octets out of an 8-octet IV, and such a sentence
would remove that concern.
Section 2, par 1 ends like this:
"That is, for each key, no IV value can be used more than once. This
restriction on IV usage is imposed on ESP CTR, ESP GCM, and ESP CCM.
In cryptographic terms, the IV is a nonce."
Right after that, we could add: "(Note that CBC mode requires
IVs that
are unpredictable. CTR, GCM, GMAC, and CCM do not have these
restrictions.)
I'm fine with adding something in Section 3 or 6 too. In Section 3
we could say "Neither the SID nor the SSIV fields need to be
unpredictable. The uniqueness requirements described above
meet all
of the security requirements of CTR, GCM, GMAC, and CCM modes."
Wordsmithing welcome.
(2) The first two bullet items in Section 4 are not as clear
as they could be:
- It is unclear whether the first requirement applies across
all SAs, or on an SA by SA basis.
Good point. I suggest something like"
"For each SA for which sender identifiers are used, the GKMS
MUST NOT
give the same sender identifier to more than one active group
member ... "
- There is almost no discussion about what happens if the
SHOULD in the second bullet is not followed.
I think the first requirement is on an SA by SA basis (that
should be stated), and then the explanation of the SHOULD in
the second requirement can be two-fold:
- Avoids need to manage SIDs on a per-SA basis in not only
the GKMS, but also the senders (the latter is probably
the more important consideration).
- Avoids any need to change/issue SIDs when rekeying an SA.
Only the latter point appears to be mentioned.
Sounds good to me.
Thanks again!
David
Thanks,
--David
----------------------------------------------------
David L. Black, Distinguished Engineer
EMC Corporation, 176 South St., Hopkinton, MA 01748
+1 (508) 293-7953 FAX: +1 (508) 293-7786
black_david at emc.com Mobile: +1 (978) 394-7754
----------------------------------------------------