Re: [AVTCORE] Ben Campbell's Yes on draft-ietf-avtcore-aria-srtp-10: (with COMMENT)

[Eric Rescorla <[e-mail]>]

On Mon, Jul 10, 2017 at 2:30 AM, Woo-Hwan Kim <[e-mail]> wrote:

> Let me reply to the comment of Ben Campbell.
> We would like to add the below to security considerations of the previous
> draft(-10).
>
> --------------------------------------------------------------------
> As a note, at the time of publication of this document, SRTP
> recommends HMAC-SHA1 as the default and mandatory-to-implement MAC
> algorithm. So all of SRTP crypto suites except GCM based ones use
> HMAC-SHA1 as their MAC algorithm to provide message authentication/
> integrity. Due to security concerns with SHA-1 [RFC6194], the IETF
> is gradually moving away from SHA-1 and towards stronger hash
> algorithms such as SHA-2 or SHA-3 families. For SRTP, however, SHA-1
> is only used in the calculation of an HMAC, and no security issue is
> known in this case. To use a secure hash algorithm such as SHA-256
> in SRTP, the values of directly related SRTP parameters
> auth_key_length and auth_tag_length should be determined considering
> the overall security and efficiency when the crypto suite is applied.
>

I don't think this last sentence makes sense. We are moving towards AEAD
algorithms, so I doubt we would ever want to publish <Cipher>-HMAC-SHA256.
I would simply remove the sentence.

-Ekr


>
> [RFC6194] Polk, T., Chen, L., Turner, S., and P. Hoffman, "Security
> Considerations for the SHA-0 and SHA-1 Message-Digest
> Algorithms", RFC 6194, DOI 10.17487/RFC6194, March 2011,
> <http://www.rfc-editor.org/info/rfc6194>.
> --------------------------------------------------------------------
>
> Sincerely, Woo-Hwan Kim
>
> -----Original Message-----
> From: Ben Campbell [mailto:[e-mail]]
> Sent: Saturday, July 08, 2017 5:33 AM
> To: The IESG <[e-mail]>
> Cc: [e-mail]; [e-mail];
> [e-mail]; [e-mail]
> Subject: Ben Campbell's Yes on draft-ietf-avtcore-aria-srtp-10: (with
> COMMENT)
>
> Ben Campbell has entered the following ballot position for
> draft-ietf-avtcore-aria-srtp-10: Yes
>
> When responding, please keep the subject line intact and reply to all
> email addresses included in the To and CC lines. (Feel free to cut this
> introductory paragraph, however.)
>
>
> Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
> for more information about IESG DISCUSS and COMMENT positions.
>
>
> The document, along with other ballot positions, can be found here:
> https://datatracker.ietf.org/doc/draft-ietf-avtcore-aria-srtp/
>
>
>
> ----------------------------------------------------------------------
> COMMENT:
> ----------------------------------------------------------------------
>
> I think it would be wise to add a paragraph to the security considerations
> to call out the dependency on SHA1. A mention of what would need to happen
> to migrate to newer hash functions could also be helpful.
>
>
>