Re: [Cfrg] request for review of IPsec ESP and AH Usage Guidance

["Blumenthal, Uri - 0558 - MITLL" <[e-mail]>]

But Yoav, my whole point was that:

- there is (almost) no reason to use AH now, as ESP handles _authetication-only_, encryption-only, encryption+authentication;

- for any use that involves encryption+authentication there is no justification (nor reason :) to use anything but one of AE encryption modes such as GCM (<b>no</b> reason to use AES-whatever plus HMAC-whatever); this includes a naïve attempt to do separate AES-CTR + AES-GMAC - just do AES-GCM instead;

- for any use that involves authentication-only (such as ESP-authenticate, or AH - doesn't matter) one SHOULD employ GMAC instead of HMAC, for reasons specified in the previous posting.

This reasoning (GMAC instead of HMAC) applies to ESP as much as to AH. 

P.S. IMHO the _only_ case when you might want to use AH at all is when you both need to authenticate a larger part of the IP header than ESP covers _and_ you want to use Transport rather than Tunnel mode of IPsec.

--
Regards,
Uri Blumenthal                            Voice: [phone]
Cyber Systems and Technology   Fax:   [phone]
MIT Lincoln Laboratory                Cell:  [phone]
244 Wood Street                        Email: <[e-mail]>
Lexington, MA  02420-9185       

Web:  http://www.ll.mit.edu/CST/

 

MIT LL Root CA: 

 <https://www.ll.mit.edu/labcertificateauthority.html>


DSN:   478-5980 ask Lincoln ext.1638

----- Original Message -----
From: Yoav Nir [mailto:[e-mail]]
Sent: Tuesday, July 02, 2013 04:31 PM
To: Blumenthal, Uri - 0558 - MITLL
Cc: Paul Hoffman <[e-mail]>; cfrg <[e-mail]>
Subject: Re: [Cfrg] request for review of IPsec ESP and AH Usage Guidance


On Jul 2, 2013, at 11:01 PM, "Blumenthal, Uri - 0558 - MITLL" <[e-mail]> wrote:
> 
> 
>>>>>> - I'm not sure about AES-GMAC for ESP authentication. Is there a reason why someone would prefer to use AES-CBC or AES-CTR with AES-GMAC rather than AES-GCM? Also, the HMAC-SHA256 algorithm has gained popularity recently (meaning that a lot of customers are asking for it). It runs significantly slower than HMAC-SHA1, but people have stopped reading at "SHA-1 is no longer secure". Still, they're not asking for GMAC, they're asking for SHA-256. So I think a document where the goal is interoperability should focus on what is becoming the de-facto standard as long as it's secure enough.
>>>>> 
>>>>> Having the document list the rationale for using GMAC instead of an HMAC would indeed be good.
>>>> 
>>>> I know, I know. Because it's faster. But we have GCM for that.
>>> 
>>> And saying so in the document would be valuable.
>> 
>> I'm still looking for the rationale for SHOULD, let alone SHOULD+ for it.
> 
> With AE modes there is no rationale to use separate encryption and authentication that I can think of.  The rationale of using GMAC instead of HMAC-SHA* is: (a) better performance, and (b) security proofs make better (to my taste) assumptions. These two should be sufficient.

And I'm not objecting to it being a SHOULD with or without + for AH. I'm only asking about ESP.