Re: [Cfrg] request for review of IPsec ESP and AH Usage Guidance

[David McGrew <[e-mail]>]

Hi Yoav,

On Tue, 2013-07-02 at 20:31 +0000, Yoav Nir wrote:
> On Jul 2, 2013, at 11:01 PM, "Blumenthal, Uri - 0558 - MITLL" <[e-mail]> wrote:
> > 
> > 
> >>>>>> - I'm not sure about AES-GMAC for ESP authentication. Is there
> a reason why someone would prefer to use AES-CBC or AES-CTR with
> AES-GMAC rather than AES-GCM? Also, the HMAC-SHA256 algorithm has
> gained popularity recently (meaning that a lot of customers are asking
> for it). It runs significantly slower than HMAC-SHA1, but people have
> stopped reading at "SHA-1 is no longer secure". Still, they're not
> asking for GMAC, they're asking for SHA-256. So I think a document
> where the goal is interoperability should focus on what is becoming
> the de-facto standard as long as it's secure enough.
> >>>>> 
> >>>>> Having the document list the rationale for using GMAC instead of
> an HMAC would indeed be good.
> >>>> 
> >>>> I know, I know. Because it's faster. But we have GCM for that.
> >>> 
> >>> And saying so in the document would be valuable.
> >> 
> >> I'm still looking for the rationale for SHOULD, let alone SHOULD+
> for it.
> > 
> > With AE modes there is no rationale to use separate encryption and
> authentication that I can think of.  The rationale of using GMAC
> instead of HMAC-SHA* is: (a) better performance, and (b) security
> proofs make better (to my taste) assumptions. These two should be
> sufficient.
> 
> And I'm not objecting to it being a SHOULD with or without + for AH.
> I'm only asking about ESP.

The most important use of an authentication transform in ESP is with
NULL encryption, in which case GMAC is the clear winner because of
adequate security and exceptional performance.  

David