Re: about rfc2393

Hovav Shacham <hovav@leland.Stanford.EDU> Sat, 12 December 1998 14:07 UTC

To: Jerome Etienne <jerome@psti.com>
Cc: "'ippcp@external.cisco.com'" <ippcp@external.cisco.com>
Subject: Re: about rfc2393
References: <31946FC09021D211BE9B00104BD1DEEE064208@dukat.psti.com>
From: Hovav Shacham <hovav@leland.Stanford.EDU>
Date: Sat, 12 Dec 1998 05:56:22 -0800
In-Reply-To: Jerome Etienne's message of "Thu, 10 Dec 1998 15:59:49 -0500"
Message-ID: <uemq5v4zd.fsf@leland.stanford.edu>
Lines: 30

Jerome Etienne <jerome@psti.com> writes:

>    When IPComp is used in the context of IPSec, it is believed not
>    to have an effect on the underlying security functionality
>    provided by the IPSec protocol; i.e., the use of compression is
>    not known to degrade or alter the nature of the underlying
>    security architecture or the encryption technologies used to
>    implement it.  [RFC 2392]
> 
> but in fact the compression increases the encryption scheme, because
> it reduces the redondancy of the plain text which is so usefull for
> cryptanalysis.

Yes and no.  Dictionary attacks play only a minor role in modern
cryptanalysis.  The encryption algorithms used in IPSec (e.g., DES in
CBC mode; see RFCs 2405 and 2406) are designed to hide plaintext
repetitions, so redundancy is probably not a problem.

Besides, it is not clear that compression hides structure.  In a
nightmare scenario, the output from compression could be structured
exactly such that decryption happens to be easy.  Making security
arguments about subsets of the plaintext space is very difficult.

I think the RFC phrasing is fine as is.

Hovav.

about rfc2393 Jerome Etienne
Re: about rfc2393 Hovav Shacham