Re: [Cfrg] tcpinc: endpoint authentication and session ID privacy

[Ilari Liusvaara <[e-mail]>]

On Sat, Oct 01, 2016 at 12:31:31PM -0400, Kyle Rose wrote:
> On Oct 1, 2016 11:48 AM, "Salz, Rich" <[e-mail]> wrote:
> >
> >
> > > The authors claim (and I am inclined to agree, though I am not a
> cryptographer) that these session IDs do not in general need to be private
> >
> >
> > Is correlation possible, such as when I move from my NATted home to
> work?  (Yes, this is a basic/naïve question, sorry.)
> 
> No: a session ID is to be used on one connection only, with a key
> derivation algorithm used by both hosts on secret IKM to derive future IDs
> for session caching/reuse. See sections 3.3-3.4 of the tcpcrypt draft for
> more information on how these identifiers are derived.

I tried reading the relevant sections, and noticed that if SID[i], for
i>0 gets disclosed, one can correlate the resumption attempt.

But I presume that the SID value used for identifying the connection is
SID[0].

Also, obviously, if one wants to use SID as secret value (AFAICT, SID[0]
qualifies as "secret nonce"), one wants to derive a separate binder for
it if the value of the binder is to be disclosed.

Also, the computation formula for PRK has concatenations. One needs to
be careful with concatenations: The components must be uniquely
parseable from concatenation.


-Ilari