[AVTCORE] draft-ietf-avtcore-srtp-aes-gcm-16: Removing cipher with short (8 bytes) authentication tag

[Magnus Westerlund <[e-mail]>]

Authors and WG,

I have heard no feedback on the raised issue and now this version comes 
along. I am not happy that a new version is submitted without prior 
discussion on the changes when we are at these stages.

Having looked at the changes and the updated disussion of the 
authentication tag. According to my understanding this section does 
nothing to resolve the raised security issues with short tags. Some 
statement also appear to be incorrect. For example:

Third paragraph, last sentence:

  "Note that silently discarding invalid packets blocks this attack."

This is not true in SRTP. Because a successful forge can be used to 
trigger a response, e.g. sending an RTCP feedback packet or emitting a 
RTP header extension, thus allowing the attacker to use the receiver and 
sender as an oracle, thus utilizing the Fergueson attack to determine 
the authorization key.

Fourth Paragraph:

    NIST recommends mitigating this attack by limiting the number of
    packets sent to at most 2^37 before the keys must be changed.

Looking at the NIST SP-800-38D specification in section 8.3 I find the 
following regarding usage when you do not meet the requirements, which 
do applies for shortened tags:

"The total number of invocations of the authenticated encryption 
function shall not exceed 2^32, including all IV lengths and
all instances of the authenticated encryption function with
the given key."

Thus the errors in the above statement is three.

1. NIST requires, not recommends
2. The number of packets processed must not be larger than 2^32
3. The above says sent, but the NIST specification is for invocations, 
which will apply to a receiver. So if more than 2^32 packets for one RT 
stream, valid or not are processed in the receiver the given key must 
not be used more.

I think error 3 is very important to understand, as it sets very hard 
operational limits on SRTP. As the number of packets that matters are 
both the desired traffic and the attack traffic one can reach this limit 
quite quickly. This also creates a denial of service possibility on the 
session, where an attacker sends bogus traffic simply to exhaust the 
allowed invocations. I am also worrying what this invocation limit means 
for group scenarios where multiple endpoints share the same key. This 
may further reduce the number of invocations with a factor corresponding 
to the number of participants.


My understanding of the situation is such that the Fergueson attack on 
AES-GCM authentication is possible with SRTP. Therefore, short 
authentication tags are simply unsafe with SRTP. Thus, we as WG have no 
choice than to remove the short tags.

If anyone disagree with this, you need to speak up before 25th of June.

Regards

Magnus Westerlund
WG chair




[e-mail] skrev den 2015-06-05 15:36:
>
> A New Internet-Draft is available from the on-line Internet-Drafts directories.
>   This draft is a work item of the Audio/Video Transport Core Maintenance Working Group of the IETF.
>
>          Title           : AES-GCM Authenticated Encryption in Secure RTP (SRTP)
>          Authors         : David A. McGrew
>                            Kevin M. Igoe
> 	Filename        : draft-ietf-avtcore-srtp-aes-gcm-16.txt
> 	Pages           : 49
> 	Date            : 2015-06-05
>
> Abstract:
>     This document defines how the AES-GCM Authenticated Encryption with
>     Associated Data family of algorithms can be used to provide
>     confidentiality and data authentication in the SRTP protocol.
>
>
>
> The IETF datatracker status page for this draft is:
> https://datatracker.ietf.org/doc/draft-ietf-avtcore-srtp-aes-gcm/
>
> There's also a htmlized version available at:
> https://tools.ietf.org/html/draft-ietf-avtcore-srtp-aes-gcm-16
>
> A diff from the previous version is available at:
> https://www.ietf.org/rfcdiff?url2=draft-ietf-avtcore-srtp-aes-gcm-16
>
>
> Please note that it may take a couple of minutes from the time of submission
> until the htmlized version and diff are available at tools.ietf.org.
>
> Internet-Drafts are also available by anonymous FTP at:
> ftp://ftp.ietf.org/internet-drafts/
>
> _______________________________________________
> Audio/Video Transport Core Maintenance
> [e-mail]
> https://www.ietf.org/mailman/listinfo/avt
>


-- 

Magnus Westerlund

----------------------------------------------------------------------
Services, Media and Network features, Ericsson Research EAB/TXM
----------------------------------------------------------------------
Ericsson AB                 | Phone  [phone]
Färögatan 6                 | Mobile [phone]
SE-164 80 Stockholm, Sweden | mailto: [e-mail]
----------------------------------------------------------------------