Re: [Cfrg] Encrypt in place guidance

[Robert Moskowitz <[e-mail]>]

There is no way the basic messages are changing and expanding as long as 
BT4 is used.

There is an auth message that can carry multiple basic messages.  We 
have a draft in DRIP:

draft-wiethuechter-drip-auth

That provides message protection.  This is up to 10 chained BT4 
broadcasts.  Or 1 BT5 broadcast.

Yes, replay attacks are pretty much built into this architecture. The 
major vendors don't get it or don't care (many are chinese companies).  
The regulators just think this is ATM a little bigger.

We do what we can with what we have.  Build each message the best way 
and make sure they all work better inside the Auth wrapper.

And this does not obviate the need for privacy of the operator 
information.  That would still need to be encrypted.

All a work in progress.  Too many SDOs and regulators involved.

On 4/1/20 2:49 AM, Björn Haase wrote:
>
> I fear that you might actually need at least some more bytes of 
> payload in order to get any sound scheme realized.
>
> For preventing replay attacks a 32 bit nonce and a 32 bit 
> authentication tag might have to be considered to form the bare 
> minimum requirement ☹.
>
> We have had a similar problem with the severely size-limited 
> BluetoothLE advertising (broadcast) packets.
>
> One option that we use is segmenting the information by splitting it 
> into several packets. This way reception of two or more separate
>
> packets is needed in order to get the full information.
>
> Mit freundlichen Grüßen I Best Regards
>
> Dr. Björn Haase
>
> ------------------------------------------------------------------------
> Senior Expert Electronics | TGREH Electronics Hardware
>
> *Endress+Hauser Liquid Analysis*
>
> Endress+Hauser Conducta GmbH+Co.KG | Dieselstrasse 24 | 70839 
> Gerlingen | Germany
> Phone: [phone] | Fax: [phone]
> [e-mail] | www.conducta.endress.com
>
> ------------------------------------------------------------------------
>
> Endress+Hauser Conducta GmbH+Co.KG
> Amtsgericht Stuttgart HRA 201908
> Sitz der Gesellschaft: Gerlingen
> Persönlich haftende Gesellschafterin:
> Endress+Hauser Conducta
> Verwaltungsgesellschaft mbH
> Sitz der Gesellschaft: Gerlingen
> Amtsgericht Stuttgart HRA 201929
> Geschäftsführer: Dr. Manfred Jagiella
>
> ------------------------------------------------------------------------
>
> Gemäss Datenschutzgrundverordnung sind wir verpflichtet, Sie zu 
> informieren, wenn wir personenbezogene Daten von Ihnen erheben.
>
> Dieser Informationspflicht kommen wir mit folgendem Datenschutzhinweis 
> <https://www.de.endress.com/de/cookies-endress+hauser-website> nach.
>
> ------------------------------------------------------------------------
>
> Disclaimer:
>
> The information transmitted is intended only for the person or entity 
> to which it is addressed and may contain confidential, proprietary, 
> and/or privileged
> material. Any review, retransmission, dissemination or other use of, 
> or taking of any action in reliance upon, this information by persons 
> or entities
> other than the intended recipient is prohibited. If you receive this 
> in error, please contact the sender and delete the material from any 
> computer.
> This e-mail does not constitute a contract offer, a contract 
> amendment, or an acceptance of a contract offer unless explicitly and 
> conspicuously designated or stated as such.
>
>
> _______________________________________________
> Cfrg mailing list
> [e-mail]
> https://www.irtf.org/mailman/listinfo/cfrg