Re: [saag] [Cfrg] Re: TCP-AO MAC algorithms

On Fri, 04 Jan 2008 11:35:17 +0800
Sean Shuo Shen <sshen@huawei.com> wrote:

> Thank you Steven.
> 
> >>Sean Shuo Shen <sshen@huawei.com> wrote:
> >> Hi Stephen,
> >> Can you talk more details about the FIPS evaluation problem?
>  
> >The issue is what the assurance boundary is.  If the TCP sequence
> >number is cryptographically significant, the entire process by which
> >it's set (including original generation and anything else in the
> >stack or kernel that could touch it) has to be part of the
> >evaluation, too.
> 
> The isn generation of some windows versions and linux is not random
> enough and is vulnerable (like RST attack). So the seq num can not be
> a source for randomness. But if a seq num is used just as an index
> instead of a random seed, it is not cryptographically significant and
> I don't think it will affect the cryptographic strength. What do you
> think, Steven?
> 
The questions to ask are (a) what are the consequences if there's a
collision or repetition; (b) what are the consequences if the enemy
can predict the value; (c) can the enemy cause such things, with some
probability; and (d) if the answer to the previous questions indicates
potential trouble, what are the assurances that trouble won't happen?

For example -- in a straight RFC 793 TCP, the approximate value of an
ISN is knowable; after all, that's how sequence number attacks are
launched.  If RFC 1948 sequence numbers are used, the ISN of a new
instance of a connection 4-tuple is approximately knowable. The sequence
numbers of subsequent packets in a connection are 100% knowable.  The
answer to (c) is yes, the attacker will generally know it.  Is this a
problem?  

I've lost track of what specific algorithm is being discussed here, so
I won't try to answer in detail, but in general these are the kinds of
questions that have to be answered.

		--Steve Bellovin, http://www.cs.columbia.edu/~smb

_______________________________________________
Cfrg mailing list
Cfrg@ietf.org
https://www1.ietf.org/mailman/listinfo/cfrg