Re: [babel] Some open HMAC issues

[Toke Høiland-Jørgensen <[e-mail]>]

David Schinazi <[e-mail]> writes:

>> On Jul 2, 2018, at 10:19, Toke Høiland-Jørgensen <[e-mail]> wrote:
>> 
>> Hmm, I'm not sure that I am convinced that it is worth the tradeoff to
>> add the key ID. But assuming it is: Is there any reason why this ID
>> needs to be user configured? We could just define it as a 16-bit
>> truncated hash of the key itself, or something like that?
>
> I like this idea, but we'd have to be careful to not open up offline
> attacks this way.

Yeah, it should be purely an optimisation, and all security properties
should be derived from the full HMAC. And we should be able to handle
duplicate keyIDs due to collisions.

So as long as it is implemented as:

if (keyid != hash16bit(key_bytes)) {
  skip HMAC tlv
}

and not

if (keyid == hash16bit(key_bytes) && !is_valid(hmac)) {
  reject packet
}

we should be fine, I think...

-Toke