[AVTCORE] Comments on the draft-ietf-avtcore-srtp-aes-gcm-01

[Woo-Hwan Kim <[e-mail]>]

Hi.

Here are some comments on the draft-ietf-avtcore-srtp-aes-gcm-01.

1. typos and minors

p.4 DTLS -> DTLS-SRTP
p.8 ROS -> ROC
p.11 the corresponding STRCP encrypted -> the corresponding SRTCP encrypted
p.13 C_max -> C_MAX
p.18 AEAD_AES_128_CCM -> AEAD_AES_128_GCM
p.18 AEAD_AES_256_CCM -> AEAD_AES_256_GCM

2. On the CCM decryption

In this draft, there is no separation between GCM and CCM except
"Tag_Size_Flag“.
It means both modes have the same parameters (nonce length, counter block
length etc.) and the same IV format (described in Sections 8.1 and 9.1).
But that does not hold if the authors intend to apply the interfaces of CCM
described in RFC 5116.
For example, the counter block length parameter q is not 4 but 3 when the
length of nonce is 12 octets.

According to the InputFormatting Function proposed in NIST SP 800-38C (and
referred by RFC 5116),
Tag_Size_Flag recommended in this draft is derived when q=3.
Note that such parameter is related to several AEAD parameters, and so a
large portion of the draft should be revised.

3. CCM Tag Validation

Section 5.3 says
"The ciphertext MUST NOT be decrypted until the AEAD tag has been
validated. The associated data
MUST NOT be released until the AEAD tag has been validated."

The above does not hold for CCM mode of operation,
because it is required to decrypt ciphertext before confirming the
validation of the AEAD tag.

4. Ciphertext length expansion for SRTP

Section 9.2 says
"Since the AEAD cipher is larger than the plaintext by exactly the length
of the AEAD authentication
tag, the corresponding STRCP encrypted packet replaces the plaintext field
with a slightly larger
field containing the cipher."

Does this sentence only hold for SRTCP?

5. Input/output data for CCM (Sections 5.2.1 and 5.2.2)

Both input and output data for CCM require Tag_Size_Flag, but that is the
value which can be computed
by three parameters (defined in NIST SP 800-38C). Because Tag_Size_Flag is
not included in SRTP/SRTCP
packets, the only way to share the same Tag_Size_Flag is to fix
authentication tag length and counter
block length in advance.

Additionally, Section 5.2.1 says the only output of "Encrypt Mode" is
"Ciphertext" with bit string length = legnth length(ciphertext)-tag_length.
What is the difference between "ciphertext" and "Ciphertext". If length of
the "Ciphertext" does not consider the length of "authentication tag",
where is authentication tag?


6. CCM tag length specification

Section 10.3

RFC5116 only defines AEAD_AES_128/256_CCM with 16 octets tag length.

Section 13.2

"Note that these SRTP Protection Profiles do not specify an auth_function,
auth_key_length, or
auth_tag_length because all of these profiles use AEAD algorithms, and thus
do not use a separate auth_function, auth_key, or auth_tag."

In IANA AEAD registry, there is no entry for AEAD_AES_128/256_CCM_12.
It means that there is no official reference for AES_CCM with 96-bit
authentication tag. So it is required to define
AEAD_AES_128/256_CCM_12 independently in this document, similar to
AEAD_AES_128/256_CCM_8 defined for
TLS usage(internet draft, AES-CCM Cipher Suites for TLS).

For SDES, it may be necessary to add CCM-related crypto suites with 64- and
96-bit authentication tags.

Thanks.

Woo-Hwan Kim