Re: [AVTCORE] Criticism on draft-ietf-avtcore-srtp-aes-gcm

[Magnus Westerlund <[e-mail]>]

Florian,

I would like to point out one factual error in your criticism:

The draft does mandate support for the longest 128 bit authentication
tag if one support the cipher at all. This is a quote from Section 13.1:

   Any implementation of AES-GCM SRTP MUST support both AEAD_AES_128_GCM
   and AEAD_AES_256_GCM (the versions with 16 octet AEAD authentication
   tags), and it MAY support the four other variants shown in table 1.

Similarly from 13.2 for AES-CCM

   Any implementation of AES-CCM SRTP/SRTCP MUST support both
   AEAD_AES_128_CCM and AEAD_AES_256_CCM (the versions with 16 octet
   AEAD authentication tags), and MAY support the other four variants.

But, to be fair this was changed very recently.

I would also note that the draft's security consideration section do
discuss the shorter than authentication tag length of actual
authentication protection for AES-GCM.

It is up to the WG to discuss if it thinks there should be any changes
based on your input. And I have to ask you what you think should be the
action based on your personal opinion.

Cheers

Magnus Westerlund
WG chair


On 2014-04-22 17:11, Florian Zeitz wrote:
> Hello,
> 
> I'd like to call this working group's attention to the fact that
> yesterday an article in german language[1] was published, harshly
> criticising draft-ietf-avtcore-srtp-aes-gcm-11.
> 
> The draft is therein called the NSA's newest attempt at weakening
> internet security.
> The criticism is largely based on Niels Ferguson's 2005 paper
> "Authentication weaknesses in GCM"[2].
> 
> In particular the points I can identify are:
> 
> Repeated from Ferguson's paper
> * GCM should no longer be used
> * if GCM has to be used, the authentication tag should be 128-bit
>   (the draft currently mandates implementation of the 64-bit
>    variant, the others are purely optional)
> * the paper uses telephony as an example in it's "A disastrous scenario"
>   section. Yet this draft recommends GCM for telephony
> 
> Attributed to Michael Kafka, a "security expert" from Vienna:
> * mixing confidentiality and authentication makes attacks easier
> * in practice performance gains are negligible on modern smartphones
> 
> The article also insinuates that David McGrew is deliberately
> co-authoring a draft he knows to be insecure, somehow under the pressure
> of the NSA.
> 
> While I do not necessarily personally agree with the criticism, or the
> conclusions, I would like this working group and the authors to address
> it in some way.
> 
> Regards,
> Florian Zeitz
> 
> [1] http://fm4.orf.at/stories/1737330/
> [2]
> http://csrc.nist.gov/groups/ST/toolkit/BCM/documents/comments/CWC-GCM/Ferguson2.pdf
> 
> _______________________________________________
> Audio/Video Transport Core Maintenance
> [e-mail]
> https://www.ietf.org/mailman/listinfo/avt
> 
> 


-- 

Magnus Westerlund

----------------------------------------------------------------------
Services, Media and Network features, Ericsson Research EAB/TXM
----------------------------------------------------------------------
Ericsson AB                 | Phone  [phone]
Färögatan 6                 | Mobile [phone]
SE-164 80 Stockholm, Sweden | mailto: [e-mail]
----------------------------------------------------------------------