Re: [Hipsec] Proposed new list for HIP_TRANSFORM

Am 07.01.2010 um 04:22 schrieb Andrew McGregor:

> 
> On 07/01/2010, at 7:01 AM, Miika Komu wrote:
> 
>> Robert Moskowitz wrote:
>> 
>> Hi,
>> 
>>> On 01/06/2010 12:07 PM, Miika Komu wrote:
>>>> Robert Moskowitz wrote:
>>>> 
>>>> Hi,
>>>> 
>>>>> Proposed new list for HIP_TRANSFORM:
>>>>> 
>>>>>        Suite ID                          Value
>>>>> 
>>>>>        RESERVED                          0
>>>>> 

...

>>>>>        AES-GCM with a 16 octet ICV       14    [RFC4106]
>>>> 
>>>> seems fine with me. Should the "natural" key size be reflected in some of the algorithms descriptions?
>>> I am not sure what you are alluding to here.  Key sizes for AES-based transforms start at 128 and go up.  If you are asking about those 8/12/16 sizes in CCM and GCM, that applies to the auth size.
>> 
>> do we have to negotiate AES key size?
> 
> No!  We need more suite IDs for the key sizes we're going to use.
> 
> The whole point of using suites in the first place was, once you have the suite you know everything you need to know about the crypto setup... you can literally just use the suite-id as an index into a table of all the numbers.
> 

I agree. I think we should also tie the MAC Algorithm for the HIP control packets to the transform to avoid a separate negotiation. Or can you imagine a case in which the ESP MAC algorithm and the HIP control channel MAC algorithm should differ?

Tobias

> Andrew
> _______________________________________________
> Hipsec mailing list
> Hipsec@ietf.org
> https://www.ietf.org/mailman/listinfo/hipsec

--  

Dipl.-Inform. Tobias Heer, Ph.D. Student
Distributed Systems Group 
RWTH Aachen University, Germany
tel: +49 241 80 207 76
web: http://ds.cs.rwth-aachen.de/members/heer