Re: [Detnet] DetNet Use Cases comment - time properties of cryptographic algorithms used to verify traffic

["Black, David" <[e-mail]>]

Hmm … looking at that reference, I’m tempted to split hairs by observing that the TLS/DTLS computational non-determinism arises from the padding format, which is not exactly a crypto algorithm.

OTOH, what actually matters in detnet context is determinism of the entire computation that verifies the data, which may include decryption, independent of what portions of that computation are viewed as crypto vs. not crypto.  A sentence noting determinism as an important property of the overall security computation could be a useful addition to one of the drafts.

Thanks, --David

From: Eric Rescorla [mailto:[e-mail]]
Sent: Thursday, December 20, 2018 7:51 AM
To: Black, David
Cc: Grossman, Ethan A.; [e-mail]
Subject: Re: DetNet Use Cases comment - time properties of cryptographic algorithms used to verify traffic


[EXTERNAL EMAIL]
Hmm... You actually do need to go to some effort to make symmetric algorithms constant-time. See for instance: http://www.isg.rhul.ac.uk/tls/lucky13.html


On Wed, Dec 19, 2018 at 6:47 PM Black, David <[e-mail]<mailto:[e-mail]>> wrote:
> Good question, for example do such algorithms have deterministic execution times?

Generally, yes, to a first approximation, as the algorithms used to encrypt and verify traffic are usually symmetric crypto algorithms such as AES and SHA-2 which perform the same computation regardless of input.   Non-deterministic execution times are associated with asymmetric crypto algorithms (e.g., public key algorithms), which are not typically used on a packet-by-packet basis - they’re used for session setup, including key exchange, from which keys are derived for the symmetric algorithms.

Thanks, --David

From: detnet [mailto:[e-mail]<mailto:[e-mail]>] On Behalf Of Grossman, Ethan A.
Sent: Wednesday, December 19, 2018 7:42 PM
To: [e-mail]<mailto:[e-mail]>
Cc: [e-mail]<mailto:[e-mail]>
Subject: [Detnet] DetNet Use Cases comment - time properties of cryptographic algorithms used to verify traffic


[EXTERNAL EMAIL]

Hi All,

In going over the remaining IESG review comments, there is this question on Sec 11.5 (Security). I don’t think it is worth holding up the Use Cases draft for, but it seems worth a conversation on the list.



Text from Section 11.5:

>      addition to arriving with the data content as intended, the data must

>      also arrive at the expected time.  This may present "new" security

>      challenges to implementers, and must be addressed accordingly.  There

>      are other security implications, including (but not limited to) the

>      change in attack surface presented by packet replication and

>      elimination.



Reviewer’s Comment:

Do these requirements impose new requirements on the cryptographic algorithms used to verify traffic?



Ethan’s thoughts:

Good question, for example do such algorithms have deterministic execution times? Is there a large spread between best- and worst-case execution times? Is this a topic for the Security draft? The Architecture draft? Or is this a more general matter of network (or network silicon) design/implementation/performance, and thus doesn’t get covered in DetNet drafts?
--------------------------------------------------