IETF Logo Mail Archive

Re: [babel] Rethinking HMAC authentication

David Schinazi <dschinazi@apple.com> Wed, 30 May 2018 17:58 UTC

Return-Path: <dschinazi@apple.com>
X-Original-To: babel@ietfa.amsl.com
Delivered-To: babel@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 862F4124BE8 for <babel@ietfa.amsl.com>; Wed, 30 May 2018 10:58:03 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -4.311
X-Spam-Level:
X-Spam-Status: No, score=-4.311 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, T_DKIMWL_WL_HIGH=-0.01] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=apple.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zYpB1VTAJRfa for <babel@ietfa.amsl.com>; Wed, 30 May 2018 10:58:01 -0700 (PDT)
Received: from mail-in23.apple.com (mail-out23.apple.com [17.171.2.33]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B7652128C0A for <babel@ietf.org>; Wed, 30 May 2018 10:58:01 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; d=apple.com; s=mailout2048s; c=relaxed/simple; q=dns/txt; i=@apple.com; t=1527703081; x=2391616681; h=From:Sender:Reply-To:Subject:Date:Message-id:To:Cc:MIME-version:Content-type: Content-transfer-encoding:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-reply-to:References:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=9L/hdvtQq7OlXvpxCQJcpXfTixQ5excSTJa206LwE6k=; b=LcPxdJ5+XnJanVvoTSehi2Uoy7ZO3kjV9iZLYGRR4UwgL02MEVwRreF2+vpMt65U 3dTT3EMp8S2VTBA1PH4X4bB0iqDsDsZwWao+/OSVbhjNrTvldiXYeKCeyS6sEV8W BAR2dMNJkqIUBnp9V+aVAaBx9HgLQZtRumVt+dkCjSuGX2bqPY7AkO5dQenOLx9G YtpxDYtABooA1C+gxpd6jaHrM45I4Ou+7PCkRY7WcGTzP2qED30UyAYH/mrZrI1C nnghQLK1qvVHGAUy9onwjzRorl7esyoxXVn7gyUnFdWRn4PwdKkUN3l0XBq/YPSw gIOBUC8fygRay3XV3+Q5Iw==;
X-AuditID: 11ab0217-24b109e000003e90-0f-5b0ee62865df
Received: from ma1-mtap-s02.corp.apple.com (ma1-mtap-s02.corp.apple.com [17.40.76.6]) (using TLS with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (Client did not present a certificate) by mail-in23.apple.com (Apple Secure Mail Relay) with SMTP id 4C.D5.16016.826EE0B5; Wed, 30 May 2018 10:58:01 -0700 (PDT)
MIME-version: 1.0
Content-transfer-encoding: 7bit
Content-type: text/plain; CHARSET="US-ASCII"
Received: from nwk-mmpp-sz10.apple.com (nwk-mmpp-sz10.apple.com [17.128.115.122]) by ma1-mtap-s02.corp.apple.com (Oracle Communications Messaging Server 8.0.2.2.20180329 64bit (built Mar 29 2018)) with ESMTPS id <0P9J007L2Z8ODK10@ma1-mtap-s02.corp.apple.com>; Wed, 30 May 2018 10:58:00 -0700 (PDT)
Received: from [17.192.155.180] by nwk-mmpp-sz10.apple.com (Oracle Communications Messaging Server 8.0.2.2.20180403 64bit (built Apr 3 2018)) with ESMTPSA id <0P9J002ZVZ8O0T20@nwk-mmpp-sz10.apple.com>; Wed, 30 May 2018 10:58:00 -0700 (PDT)
X-Va-A:
X-Va-T-CD: d59661a006d810078864a2b5ec0f053f
X-Va-E-CD: 364ba9793b3bbfb9221b229b541cb094
X-Va-R-CD: 27f632e87b0ecd4c43e83a63c73bf407
X-Va-CD: 0
X-Va-ID: 647d4418-96cf-4342-97a4-4c252f462b9f
X-V-A:
X-V-T-CD: 7d6566e1ce32e60bd701207e1252a9a5
X-V-E-CD: 364ba9793b3bbfb9221b229b541cb094
X-V-R-CD: 27f632e87b0ecd4c43e83a63c73bf407
X-V-CD: 0
X-V-ID: 941ee6c2-7662-4fe4-aaec-13ff68ca9985
X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:,, definitions=2018-05-30_08:,, signatures=0
Sender: dschinazi@apple.com
From: David Schinazi <dschinazi@apple.com>
In-reply-to: <87sh6915ix.wl-jch@irif.fr>
Date: Wed, 30 May 2018 10:57:59 -0700
Cc: Babel at IETF <babel@ietf.org>, Weronika Kołodziejak <weronika.kolodziejak@gmail.com>, Clara Dô <clarado_perso@yahoo.fr>
Message-id: <B95394FD-7C1F-46F5-808C-70176F09A261@apple.com>
References: <87sh6915ix.wl-jch@irif.fr>
To: Juliusz Chroboczek <jch@irif.fr>
X-Mailer: Apple Mail (2.3445.5.20)
X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFrrEIsWRmVeSWpSXmKPExsUiqOHDpqv5jC/a4MpcRosti7pZLDZcXsds Mb91GZvFh093WB1YPHbOusvusWTJTyaPxVveMnq8mv6QPYAlissmJTUnsyy1SN8ugStj/dL3 LAULmCuebN/D0sC4k6mLkZNDQsBE4tLsXvYuRi4OIYH9TBLNm1cygiR4BQQlfky+x9LFyMHB LCAvcfC8LEiYWUBL4vujVhaI+o1MEg1v3zBDON8YJS69vAs1lV3iz68dLBC2tsTBO8tYYeyL T5Yxw9iTn/1ghLC5JBZsPc0KskxCQFdi/n8NiDCbxPoTS6BGakk83f6cFcZe0NTLCGMvu30a ahWnxPkvE9khbB2JQ3tnQ9VkS/ydfRQsLiwgLdF14S4rhG0sMffJPiaQtWxAcw6sMQIJcwpo SGzY2cYGYrMIqEq8+f8T7EVmgYWMEi8fNLJDwsdGYvKjI2BzhATUJW6fOg72loiAisTyac+g blCSmP79NtsERrlZSEE6CxGks5CCdAEj8ypG4dzEzBzdzDwjY73EgoKcVL3k/NxNjKBEsJpJ fAfj59eGhxgFOBiVeHg3rOSLFmJNLCuuzD3EKM3BoiTOuzCII1pIID2xJDU7NbUgtSi+qDQn tfgQIxMHp1QDI4v6Y7UK+aXSFw1UnkTd7q/e73HL6YWwT2yE/+XV+qofrsxhcn2Q+758RW4w g3KSR9BfJbHtEaF1d2QVj7vwtFxYy5HbtFbTbvOlmUEKrFu8Jx3t4TqeumtfbL5L4gKhgvLl POvTFs6a7ttelHqOa9teRakWi9uF8vOvFmdWnRO41fl08ncfJZbijERDLeai4kQA4I7nD+UC AAA=
Archived-At: <https://mailarchive.ietf.org/arch/msg/babel/mRfdScmm2TKoZzNnqJmWGxv0rqo>
Subject: Re: [babel] Rethinking HMAC authentication
X-BeenThere: babel@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: "A list for discussion of the Babel Routing Protocol." <babel.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/babel>, <mailto:babel-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/babel/>
List-Post: <mailto:babel@ietf.org>
List-Help: <mailto:babel-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/babel>, <mailto:babel-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 30 May 2018 17:58:04 -0000

Thanks for sharing Juliusz, this is interesting!

> On May 30, 2018, at 09:18, Juliusz Chroboczek <jch@irif.fr> wrote:
> 
>     - when receiving a packet, we don't need to do a first parse of the
>       whole packet before checking the HMAC, we jump directly to the
>       packet trailer.

Don't you still need to do a first parse of the whole packet to extract
the TS/PC for replay protection?

David

v2.46.0 | Report a Bug | By Email | System Status