Re: [AVTCORE] Kathleen Moriarty's No Objection on draft-ietf-avtcore-aria-srtp-10: (with COMMENT)

Kathleen Moriarty <kathleen.moriarty.ietf@gmail.com> Thu, 03 August 2017 13:27 UTC

Return-Path: <kathleen.moriarty.ietf@gmail.com>
X-Original-To: avt@ietfa.amsl.com
Delivered-To: avt@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 157BF131FFA; Thu, 3 Aug 2017 06:27:34 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2
X-Spam-Level:
X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id f13BAfyB4sSq; Thu, 3 Aug 2017 06:27:32 -0700 (PDT)
Received: from mail-pf0-x22c.google.com (mail-pf0-x22c.google.com [IPv6:2607:f8b0:400e:c00::22c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 61A4B131FFD; Thu, 3 Aug 2017 06:27:32 -0700 (PDT)
Received: by mail-pf0-x22c.google.com with SMTP id d67so6405766pfc.0; Thu, 03 Aug 2017 06:27:32 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-transfer-encoding; bh=5j3EdWQq0jeWfMArBoqyOYfx8wlmd6MR17HoiEqMYec=; b=LujsaNIhLhm+ZYP9tVlS0O64QqKAo20+7ULes7g/bx4YbPMd94twmIcfjTHLPnWlL4 XqsOIUurbpm9+Io4t3E4Af0EmnwEDLGO254xCAp4RUxXIvnrT1UT+8a1OtaeIzJw5Nfd 95GbCtUJwMR6jaGYoYY41uCJCwkAwwYAePyAqCeEpjbNllUYPt5R6xDMYCG9owZO0j4p JtnyPRfQ8WyEqxRg9d14bLnO/iqG1ugFCJXLzA4dap9dtk1m3tarloTTTUPK9uJECwoD Gi15YGd19LoWxq0gHDyKp5P2yJnwmQv1h8o0N15fjPncRVkA3qUSGmn34wgHBaq3w0XG Iz7A==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc:content-transfer-encoding; bh=5j3EdWQq0jeWfMArBoqyOYfx8wlmd6MR17HoiEqMYec=; b=nE7FqHKJmkySqIXAeGLcJq1+fdrZKgPNsPdYxIzPvKUzFZaIc7xzfqHjh5hJYipWM6 9IHHt1AjG+QOy9oLI8ZeTWK8ycmRlkcuhTssUS7is0N9sGh19rQ3feWjULu/s2d3rVs0 bmuw4Wetb0VcbE3vjm3sS4AdFCSBpI6UraXUFL1VhCPGaRPh368YIP/ZqTHCcgS9aBDa TEzzPQa5FZTuoVuS6CYXtgzhtmsbRHM4seOjrpPHibSc9sOt8cZoAZ7FDFAaUbPr+nfM DfnA4FndwBtz/3NXjU2z28F6WgKoxwRE7HypZyLE21vBrHdDQU+mmVwRDFaszEBgvR1Q S+Eg==
X-Gm-Message-State: AIVw111ET7kTqiKKVtfgNxEOK1wzKuOoafNZKlS7C0DGCSbGXZr/qfGc T2Mfd4J6XEOdMaOecq+8CE4BeUPhlw==
X-Received: by 10.84.129.103 with SMTP id 94mr1888900plb.63.1501766851979; Thu, 03 Aug 2017 06:27:31 -0700 (PDT)
MIME-Version: 1.0
Received: by 10.100.144.1 with HTTP; Thu, 3 Aug 2017 06:26:51 -0700 (PDT)
In-Reply-To: <D666082B-4DBF-406E-AC6C-03493A376A53@nostrum.com>
References: <150172505031.5791.14553211399724965332.idtracker@ietfa.amsl.com> <084BEE4A-1241-42C6-BD39-36F11792ABB4@nostrum.com> <CAHbuEH4+R8KguTtLdoGnGdom1YB6Cp0XD5nLTm-YUMHaLsXxuw@mail.gmail.com> <D666082B-4DBF-406E-AC6C-03493A376A53@nostrum.com>
From: Kathleen Moriarty <kathleen.moriarty.ietf@gmail.com>
Date: Thu, 3 Aug 2017 09:26:51 -0400
Message-ID: <CAHbuEH6JJNq9QmAi9Dbg15-SctUS+c6FArW94KqfRzVP_g4gGw@mail.gmail.com>
To: Ben Campbell <ben@nostrum.com>
Cc: The IESG <iesg@ietf.org>, avtcore-chairs@ietf.org, Roni Even <roni.even@huawei.com>, draft-ietf-avtcore-aria-srtp@ietf.org, avt@ietf.org
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Archived-At: <https://mailarchive.ietf.org/arch/msg/avt/aks80OgyBlaui2XDxCYrXQo0Qw4>
Subject: Re: [AVTCORE] Kathleen Moriarty's No Objection on draft-ietf-avtcore-aria-srtp-10: (with COMMENT)
X-BeenThere: avt@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: Audio/Video Transport Core Maintenance <avt.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/avt>, <mailto:avt-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/avt/>
List-Post: <mailto:avt@ietf.org>
List-Help: <mailto:avt-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/avt>, <mailto:avt-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 03 Aug 2017 13:27:34 -0000

Hi Ben,

On Wed, Aug 2, 2017 at 11:15 PM, Ben Campbell <ben@nostrum.com> wrote:
>
>> On Aug 2, 2017, at 9:50 PM, Kathleen Moriarty <kathleen.moriarty.ietf@gmail.com> wrote:
>>
>> Hi Ben,
>>
>> Thanks for the quick response, inline.
>>
>> On Wed, Aug 2, 2017 at 10:36 PM, Ben Campbell <ben@nostrum.com> wrote:
>>>
>>>
>>>
>>>> On Aug 2, 2017, at 8:50 PM, Kathleen Moriarty <kathleen.moriarty.ietf@gmail.com> wrote:
>>>> ----------------------------------------------------------------------
>>>> COMMENT:
>>>> ----------------------------------------------------------------------
>>>>
>>>> Although this is not a discuss, I think updated text would be very helpful on
>>>> the following two issues.
>>>>
>>>> I agree with the SecDir reviewer that there should be more text around the
>>>> short tag length in the security considerations section.  I don't see a
>>>> response to that post though.
>>>>
>>>
>>> Hi Kathleen,
>>>
>>> I think you are referring to Ben Laurie’s SecDir review of 06, rather than his later review of 09. Is that correct? Version 9 removed the GCM_8 modes. Or were you referring to something else?
>>
>> I am referring to Ben's review of -06, where he had the following text:
>>
>> Thirdly, I am not familiar enough with SRTP to understand why short
>> authentication tags are needed, but in general its a bad idea, so I
>> feel the Security Considerations should explain more fully than
>> "Ciphersuites with short tag length may be
>>   considered for specific application environments stated in 7.5 of
>>   [RFC3711], but the risk of weak authentication described in
>>   Section 9.5.1 of [RFC3711] should be taken into account."
>>
>> I don't see an update to this text to address his question - providing
>> additional information as to what should be "taken into account”.
>
> I had assumed his concern was about short tags in GCM mode, namely the following:
>
>        AEAD_ARIA_128_GCM_8
>        AEAD_ARIA_256_GCM_8
>        AEAD_ARIA_128_GCM_12
>        AEAD_ARIA_256_GCM_12
>
> These have all been removed as of version 09. Ben’s review of 09 made no further mention of short tags.

Thanks, but the text warning about them remains in the security
considerations section.  Is it needed for some reason?

Kathleen

>
> Are there suites still in version 09 that you think need further discussion in the security considerations?  I think the authors would happily add something if we can tell them what is needed, but I’m certainly not the expert here.
>
> Ben.
>



-- 

Best regards,
Kathleen