Re: [AVTCORE] Kathleen Moriarty's No Objection on draft-ietf-avtcore-aria-srtp-10: (with COMMENT)

[Ben Campbell <[e-mail]>]

> On Aug 2, 2017, at 9:50 PM, Kathleen Moriarty <[e-mail]> wrote:
> 
> Hi Ben,
> 
> Thanks for the quick response, inline.
> 
> On Wed, Aug 2, 2017 at 10:36 PM, Ben Campbell <[e-mail]> wrote:
>> 
>> 
>> 
>>> On Aug 2, 2017, at 8:50 PM, Kathleen Moriarty <[e-mail]> wrote:
>>> ----------------------------------------------------------------------
>>> COMMENT:
>>> ----------------------------------------------------------------------
>>> 
>>> Although this is not a discuss, I think updated text would be very helpful on
>>> the following two issues.
>>> 
>>> I agree with the SecDir reviewer that there should be more text around the
>>> short tag length in the security considerations section.  I don't see a
>>> response to that post though.
>>> 
>> 
>> Hi Kathleen,
>> 
>> I think you are referring to Ben Laurie’s SecDir review of 06, rather than his later review of 09. Is that correct? Version 9 removed the GCM_8 modes. Or were you referring to something else?
> 
> I am referring to Ben's review of -06, where he had the following text:
> 
> Thirdly, I am not familiar enough with SRTP to understand why short
> authentication tags are needed, but in general its a bad idea, so I
> feel the Security Considerations should explain more fully than
> "Ciphersuites with short tag length may be
>   considered for specific application environments stated in 7.5 of
>   [RFC3711], but the risk of weak authentication described in
>   Section 9.5.1 of [RFC3711] should be taken into account."
> 
> I don't see an update to this text to address his question - providing
> additional information as to what should be "taken into account”.

I had assumed his concern was about short tags in GCM mode, namely the following: 

       AEAD_ARIA_128_GCM_8 
       AEAD_ARIA_256_GCM_8
       AEAD_ARIA_128_GCM_12 
       AEAD_ARIA_256_GCM_12 

These have all been removed as of version 09. Ben’s review of 09 made no further mention of short tags.

Are there suites still in version 09 that you think need further discussion in the security considerations?  I think the authors would happily add something if we can tell them what is needed, but I’m certainly not the expert here.

Ben.