[dtn-security] Re(4): Ciphersuite

Peter Lovell <plovell@mac.com> Thu, 16 July 2009 19:06 UTC

MIME-version: 1.0
Content-transfer-encoding: 7bit
Content-type: text/plain; charset="ISO-8859-1"
From: Peter Lovell <plovell@mac.com>
To: Sushil Chaudhari <schaudhari@mzeal.com>, dtn-security@maillists.intel-research.net
Date: Thu, 16 Jul 2009 15:04:23 -0400
Message-id: <20090716190423.1267272697@smtp.mac.com>
In-reply-to: <20090716180755.89960.qmail@mzeal.com>
References: <20090716180755.89960.qmail@mzeal.com>
Subject: [dtn-security] Re(4): Ciphersuite
Precedence: list

On Thu, Jul 16, 2009, Sushil Chaudhari <schaudhari@mzeal.com> wrote:

>Hi,
>
>It looks as PC3 ciphersuite actually implemented for AES GCM mode. If I
>read RFC4106 correctly, it does provide confidentiality, data origin and
>data integrity authentication...
>
>Apparently, it does fulfill the purpose of all 3 security blocks.
>
>Am I read something incorrectly?

Your analysis is a bit to simplistic. PC3 does guarantee that the
payload data (and only the payload data) has not been changed in
transit. But there's no "certificate of authenticity". You do not know
who originated the data.

You know it is unmodified but you don't know if it's genuine.

With PIB you get a signature from the sender so you know, within the
constraints of your keying mechanism, who actually sent the data.

Regards....Peter

[dtn-security] Re(4): Ciphersuite Peter Lovell
Re: [dtn-security] Re(2): Ciphersuite Sushil Chaudhari