[AVTCORE] help

["Qasim Y. Khan" <[e-mail]>]

On Thu, Aug 3, 2017 at 6:55 PM, <[e-mail]> wrote:

> Send avt mailing list submissions to
>         [e-mail]
>
> To subscribe or unsubscribe via the World Wide Web, visit
>         https://www.ietf.org/mailman/listinfo/avt
> or, via email, send a message with subject or body 'help' to
>         [e-mail]
>
> You can reach the person managing the list at
>         [e-mail]
>
> When replying, please edit your Subject line so it is more specific
> than "Re: Contents of avt digest..."
>
>
> Today's Topics:
>
>    1. Kathleen Moriarty's No Objection on
>       draft-ietf-avtcore-aria-srtp-10: (with COMMENT) (Kathleen Moriarty)
>    2. Re: Kathleen Moriarty's No Objection on
>       draft-ietf-avtcore-aria-srtp-10: (with COMMENT) (Ben Campbell)
>    3. Re: Kathleen Moriarty's No Objection on
>       draft-ietf-avtcore-aria-srtp-10: (with COMMENT) (Kathleen Moriarty)
>    4. Re: Kathleen Moriarty's No Objection on
>       draft-ietf-avtcore-aria-srtp-10: (with COMMENT) (Ben Campbell)
>    5. Re: Kathleen Moriarty's No Objection on
>       draft-ietf-avtcore-aria-srtp-10: (with COMMENT) (Kathleen Moriarty)
>    6. Re: Kathleen Moriarty's No Objection on
>       draft-ietf-avtcore-aria-srtp-10: (with COMMENT) (Ben Campbell)
>
>
> ----------------------------------------------------------------------
>
> Message: 1
> Date: Wed, 02 Aug 2017 18:50:50 -0700
> From: Kathleen Moriarty <[e-mail]>
> To: "The IESG" <[e-mail]>
> Cc: [e-mail], Roni Even
>         <[e-mail]>, [e-mail],
> [e-mail],
>         [e-mail]
> Subject: [AVTCORE] Kathleen Moriarty's No Objection on
>         draft-ietf-avtcore-aria-srtp-10: (with COMMENT)
> Message-ID:
>         <[e-mail]>
> Content-Type: text/plain; charset="utf-8"
>
> Kathleen Moriarty has entered the following ballot position for
> draft-ietf-avtcore-aria-srtp-10: No Objection
>
> When responding, please keep the subject line intact and reply to all
> email addresses included in the To and CC lines. (Feel free to cut this
> introductory paragraph, however.)
>
>
> Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
> for more information about IESG DISCUSS and COMMENT positions.
>
>
> The document, along with other ballot positions, can be found here:
> https://datatracker.ietf.org/doc/draft-ietf-avtcore-aria-srtp/
>
>
>
> ----------------------------------------------------------------------
> COMMENT:
> ----------------------------------------------------------------------
>
> Although this is not a discuss, I think updated text would be very helpful
> on
> the following two issues.
>
> I agree with the SecDir reviewer that there should be more text around the
> short tag length in the security considerations section.  I don't see a
> response to that post though.
>
> For SHA-1, a reference to RFC6194 for the security considerations for
> SHA-1message digest algorithms would be helpful. Thank you!
>
>
>
>
> ------------------------------
>
> Message: 2
> Date: Wed, 2 Aug 2017 21:36:31 -0500
> From: Ben Campbell <[e-mail]>
> To: Kathleen Moriarty <[e-mail]>
> Cc: The IESG <[e-mail]>, [e-mail],
>         [e-mail], [e-mail],
>         [e-mail]
> Subject: Re: [AVTCORE] Kathleen Moriarty's No Objection on
>         draft-ietf-avtcore-aria-srtp-10: (with COMMENT)
> Message-ID: <[e-mail]>
> Content-Type: text/plain; charset=utf-8
>
>
>
>
> > On Aug 2, 2017, at 8:50 PM, Kathleen Moriarty <
> [e-mail]> wrote:
> > ----------------------------------------------------------------------
> > COMMENT:
> > ----------------------------------------------------------------------
> >
> > Although this is not a discuss, I think updated text would be very
> helpful on
> > the following two issues.
> >
> > I agree with the SecDir reviewer that there should be more text around
> the
> > short tag length in the security considerations section.  I don't see a
> > response to that post though.
> >
>
> Hi Kathleen,
>
> I think you are referring to Ben Laurie?s SecDir review of 06, rather than
> his later review of 09. Is that correct? Version 9 removed the GCM_8 modes.
> Or were you referring to something else?
>
> > For SHA-1, a reference to RFC6194 for the security considerations for
> > SHA-1message digest algorithms would be helpful. Thank you!
>
> Thanks, that?s helpful. I agree the security considerations needs to say
> something about the use of SHA1
>
> Ben.
>
>
> ------------------------------
>
> Message: 3
> Date: Wed, 2 Aug 2017 22:50:02 -0400
> From: Kathleen Moriarty <[e-mail]>
> To: Ben Campbell <[e-mail]>
> Cc: The IESG <[e-mail]>, [e-mail],  Roni Even
>         <[e-mail]>, [e-mail],
>         [e-mail]
> Subject: Re: [AVTCORE] Kathleen Moriarty's No Objection on
>         draft-ietf-avtcore-aria-srtp-10: (with COMMENT)
> Message-ID:
>         <CAHbuEH4+R8KguTtLdoGnGdom1YB6Cp0XD5nLTm
> [e-mail]>
> Content-Type: text/plain; charset="UTF-8"
>
> Hi Ben,
>
> Thanks for the quick response, inline.
>
> On Wed, Aug 2, 2017 at 10:36 PM, Ben Campbell <[e-mail]> wrote:
> >
> >
> >
> >> On Aug 2, 2017, at 8:50 PM, Kathleen Moriarty <
> [e-mail]> wrote:
> >> ----------------------------------------------------------------------
> >> COMMENT:
> >> ----------------------------------------------------------------------
> >>
> >> Although this is not a discuss, I think updated text would be very
> helpful on
> >> the following two issues.
> >>
> >> I agree with the SecDir reviewer that there should be more text around
> the
> >> short tag length in the security considerations section.  I don't see a
> >> response to that post though.
> >>
> >
> > Hi Kathleen,
> >
> > I think you are referring to Ben Laurie?s SecDir review of 06, rather
> than his later review of 09. Is that correct? Version 9 removed the GCM_8
> modes. Or were you referring to something else?
>
> I am referring to Ben's review of -06, where he had the following text:
>
> Thirdly, I am not familiar enough with SRTP to understand why short
> authentication tags are needed, but in general its a bad idea, so I
> feel the Security Considerations should explain more fully than
> "Ciphersuites with short tag length may be
>    considered for specific application environments stated in 7.5 of
>    [RFC3711], but the risk of weak authentication described in
>    Section 9.5.1 of [RFC3711] should be taken into account."
>
> I don't see an update to this text to address his question - providing
> additional information as to what should be "taken into account".
>
>
> >
> >> For SHA-1, a reference to RFC6194 for the security considerations for
> >> SHA-1message digest algorithms would be helpful. Thank you!
> >
> > Thanks, that?s helpful. I agree the security considerations needs to say
> something about the use of SHA1
>
> Great, thanks!
> >
> > Ben.
>
>
>
> --
>
> Best regards,
> Kathleen
>
>
>
> ------------------------------
>
> Message: 4
> Date: Wed, 2 Aug 2017 22:15:45 -0500
> From: Ben Campbell <[e-mail]>
> To: Kathleen Moriarty <[e-mail]>
> Cc: The IESG <[e-mail]>, [e-mail], Roni Even
>         <[e-mail]>, [e-mail],
>         [e-mail]
> Subject: Re: [AVTCORE] Kathleen Moriarty's No Objection on
>         draft-ietf-avtcore-aria-srtp-10: (with COMMENT)
> Message-ID: <[e-mail]>
> Content-Type: text/plain; charset=utf-8
>
>
> > On Aug 2, 2017, at 9:50 PM, Kathleen Moriarty <
> [e-mail]> wrote:
> >
> > Hi Ben,
> >
> > Thanks for the quick response, inline.
> >
> > On Wed, Aug 2, 2017 at 10:36 PM, Ben Campbell <[e-mail]> wrote:
> >>
> >>
> >>
> >>> On Aug 2, 2017, at 8:50 PM, Kathleen Moriarty <
> [e-mail]> wrote:
> >>> ----------------------------------------------------------------------
> >>> COMMENT:
> >>> ----------------------------------------------------------------------
> >>>
> >>> Although this is not a discuss, I think updated text would be very
> helpful on
> >>> the following two issues.
> >>>
> >>> I agree with the SecDir reviewer that there should be more text around
> the
> >>> short tag length in the security considerations section.  I don't see a
> >>> response to that post though.
> >>>
> >>
> >> Hi Kathleen,
> >>
> >> I think you are referring to Ben Laurie?s SecDir review of 06, rather
> than his later review of 09. Is that correct? Version 9 removed the GCM_8
> modes. Or were you referring to something else?
> >
> > I am referring to Ben's review of -06, where he had the following text:
> >
> > Thirdly, I am not familiar enough with SRTP to understand why short
> > authentication tags are needed, but in general its a bad idea, so I
> > feel the Security Considerations should explain more fully than
> > "Ciphersuites with short tag length may be
> >   considered for specific application environments stated in 7.5 of
> >   [RFC3711], but the risk of weak authentication described in
> >   Section 9.5.1 of [RFC3711] should be taken into account."
> >
> > I don't see an update to this text to address his question - providing
> > additional information as to what should be "taken into account?.
>
> I had assumed his concern was about short tags in GCM mode, namely the
> following:
>
>        AEAD_ARIA_128_GCM_8
>        AEAD_ARIA_256_GCM_8
>        AEAD_ARIA_128_GCM_12
>        AEAD_ARIA_256_GCM_12
>
> These have all been removed as of version 09. Ben?s review of 09 made no
> further mention of short tags.
>
> Are there suites still in version 09 that you think need further
> discussion in the security considerations?  I think the authors would
> happily add something if we can tell them what is needed, but I?m certainly
> not the expert here.
>
> Ben.
>
>
>
> ------------------------------
>
> Message: 5
> Date: Thu, 3 Aug 2017 09:26:51 -0400
> From: Kathleen Moriarty <[e-mail]>
> To: Ben Campbell <[e-mail]>
> Cc: The IESG <[e-mail]>, [e-mail],  Roni Even
>         <[e-mail]>, [e-mail],
>         [e-mail]
> Subject: Re: [AVTCORE] Kathleen Moriarty's No Objection on
>         draft-ietf-avtcore-aria-srtp-10: (with COMMENT)
> Message-ID:
>         <CAHbuEH6JJNq9QmAi9Dbg15-SctUS+c6FArW94KqfRzVP_g4gGw@
> mail.gmail.com>
> Content-Type: text/plain; charset="UTF-8"
>
> Hi Ben,
>
> On Wed, Aug 2, 2017 at 11:15 PM, Ben Campbell <[e-mail]> wrote:
> >
> >> On Aug 2, 2017, at 9:50 PM, Kathleen Moriarty <
> [e-mail]> wrote:
> >>
> >> Hi Ben,
> >>
> >> Thanks for the quick response, inline.
> >>
> >> On Wed, Aug 2, 2017 at 10:36 PM, Ben Campbell <[e-mail]> wrote:
> >>>
> >>>
> >>>
> >>>> On Aug 2, 2017, at 8:50 PM, Kathleen Moriarty <
> [e-mail]> wrote:
> >>>> ------------------------------------------------------------
> ----------
> >>>> COMMENT:
> >>>> ------------------------------------------------------------
> ----------
> >>>>
> >>>> Although this is not a discuss, I think updated text would be very
> helpful on
> >>>> the following two issues.
> >>>>
> >>>> I agree with the SecDir reviewer that there should be more text
> around the
> >>>> short tag length in the security considerations section.  I don't see
> a
> >>>> response to that post though.
> >>>>
> >>>
> >>> Hi Kathleen,
> >>>
> >>> I think you are referring to Ben Laurie?s SecDir review of 06, rather
> than his later review of 09. Is that correct? Version 9 removed the GCM_8
> modes. Or were you referring to something else?
> >>
> >> I am referring to Ben's review of -06, where he had the following text:
> >>
> >> Thirdly, I am not familiar enough with SRTP to understand why short
> >> authentication tags are needed, but in general its a bad idea, so I
> >> feel the Security Considerations should explain more fully than
> >> "Ciphersuites with short tag length may be
> >>   considered for specific application environments stated in 7.5 of
> >>   [RFC3711], but the risk of weak authentication described in
> >>   Section 9.5.1 of [RFC3711] should be taken into account."
> >>
> >> I don't see an update to this text to address his question - providing
> >> additional information as to what should be "taken into account?.
> >
> > I had assumed his concern was about short tags in GCM mode, namely the
> following:
> >
> >        AEAD_ARIA_128_GCM_8
> >        AEAD_ARIA_256_GCM_8
> >        AEAD_ARIA_128_GCM_12
> >        AEAD_ARIA_256_GCM_12
> >
> > These have all been removed as of version 09. Ben?s review of 09 made no
> further mention of short tags.
>
> Thanks, but the text warning about them remains in the security
> considerations section.  Is it needed for some reason?
>
> Kathleen
>
> >
> > Are there suites still in version 09 that you think need further
> discussion in the security considerations?  I think the authors would
> happily add something if we can tell them what is needed, but I?m certainly
> not the expert here.
> >
> > Ben.
> >
>
>
>
> --
>
> Best regards,
> Kathleen
>
>
>
> ------------------------------
>
> Message: 6
> Date: Thu, 3 Aug 2017 08:55:42 -0500
> From: Ben Campbell <[e-mail]>
> To: Kathleen Moriarty <[e-mail]>
> Cc: The IESG <[e-mail]>, [e-mail], Roni Even
>         <[e-mail]>, [e-mail],
>         [e-mail]
> Subject: Re: [AVTCORE] Kathleen Moriarty's No Objection on
>         draft-ietf-avtcore-aria-srtp-10: (with COMMENT)
> Message-ID: <[e-mail]>
> Content-Type: text/plain; charset=utf-8
>
>
> > On Aug 3, 2017, at 8:26 AM, Kathleen Moriarty <
> [e-mail]> wrote:
> >
> > Hi Ben,
> >
> > On Wed, Aug 2, 2017 at 11:15 PM, Ben Campbell <[e-mail]> wrote:
> >>
> >>> On Aug 2, 2017, at 9:50 PM, Kathleen Moriarty <
> [e-mail]> wrote:
> >>>
> >>> Hi Ben,
> >>>
> >>> Thanks for the quick response, inline.
> >>>
> >>> On Wed, Aug 2, 2017 at 10:36 PM, Ben Campbell <[e-mail]> wrote:
> >>>>
> >>>>
> >>>>
> >>>>> On Aug 2, 2017, at 8:50 PM, Kathleen Moriarty <
> [e-mail]> wrote:
> >>>>> ------------------------------------------------------------
> ----------
> >>>>> COMMENT:
> >>>>> ------------------------------------------------------------
> ----------
> >>>>>
> >>>>> Although this is not a discuss, I think updated text would be very
> helpful on
> >>>>> the following two issues.
> >>>>>
> >>>>> I agree with the SecDir reviewer that there should be more text
> around the
> >>>>> short tag length in the security considerations section.  I don't
> see a
> >>>>> response to that post though.
> >>>>>
> >>>>
> >>>> Hi Kathleen,
> >>>>
> >>>> I think you are referring to Ben Laurie?s SecDir review of 06, rather
> than his later review of 09. Is that correct? Version 9 removed the GCM_8
> modes. Or were you referring to something else?
> >>>
> >>> I am referring to Ben's review of -06, where he had the following text:
> >>>
> >>> Thirdly, I am not familiar enough with SRTP to understand why short
> >>> authentication tags are needed, but in general its a bad idea, so I
> >>> feel the Security Considerations should explain more fully than
> >>> "Ciphersuites with short tag length may be
> >>>  considered for specific application environments stated in 7.5 of
> >>>  [RFC3711], but the risk of weak authentication described in
> >>>  Section 9.5.1 of [RFC3711] should be taken into account."
> >>>
> >>> I don't see an update to this text to address his question - providing
> >>> additional information as to what should be "taken into account?.
> >>
> >> I had assumed his concern was about short tags in GCM mode, namely the
> following:
> >>
> >>       AEAD_ARIA_128_GCM_8
> >>       AEAD_ARIA_256_GCM_8
> >>       AEAD_ARIA_128_GCM_12
> >>       AEAD_ARIA_256_GCM_12
> >>
> >> These have all been removed as of version 09. Ben?s review of 09 made
> no further mention of short tags.
> >
> > Thanks, but the text warning about them remains in the security
> > considerations section.  Is it needed for some reason?
> >
>
> Ah, I get it?I thought you were asking for _more_ text :-). I think they
> put that in as a result of the 06 review, but didn?t take it out when they
> removed those modes. I will verify that the authors don?t think the warning
> applies to any of the remaining.
>
> Ben.
>
> > Kathleen
> >
> >>
> >> Are there suites still in version 09 that you think need further
> discussion in the security considerations?  I think the authors would
> happily add something if we can tell them what is needed, but I?m certainly
> not the expert here.
> >>
> >> Ben.
> >>
> >
> >
> >
> > --
> >
> > Best regards,
> > Kathleen
>
>
>
> ------------------------------
>
> Subject: Digest Footer
>
> _______________________________________________
> Audio/Video Transport Core Maintenance
> [e-mail]
> https://www.ietf.org/mailman/listinfo/avt
>
>
> ------------------------------
>
> End of avt Digest, Vol 160, Issue 2
> ***********************************
>