IETF Logo Mail Archive

Re: [ippm] WGLC for draft-ietf-ippm-twamp-06.txt

"Murtaza Chiba (mchiba)" <mchiba@cisco.com> Mon, 31 March 2008 19:42 UTC

Return-Path: <ippm-bounces@ietf.org>
X-Original-To: ippm-archive@megatron.ietf.org
Delivered-To: ietfarch-ippm-archive@core3.amsl.com
Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 51DBE3A6AB7; Mon, 31 Mar 2008 12:42:46 -0700 (PDT)
X-Original-To: ippm@core3.amsl.com
Delivered-To: ippm@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 947413A6A9F for <ippm@core3.amsl.com>; Mon, 31 Mar 2008 12:42:44 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.992
X-Spam-Level:
X-Spam-Status: No, score=-3.992 tagged_above=-999 required=5 tests=[AWL=2.607, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TRWulinYA0SS for <ippm@core3.amsl.com>; Mon, 31 Mar 2008 12:42:43 -0700 (PDT)
Received: from sj-iport-2.cisco.com (sj-iport-2.cisco.com [171.71.176.71]) by core3.amsl.com (Postfix) with ESMTP id 658073A6948 for <ippm@ietf.org>; Mon, 31 Mar 2008 12:42:43 -0700 (PDT)
Received: from sj-dkim-2.cisco.com ([171.71.179.186]) by sj-iport-2.cisco.com with ESMTP; 31 Mar 2008 12:42:41 -0700
Received: from sj-core-1.cisco.com (sj-core-1.cisco.com [171.71.177.237]) by sj-dkim-2.cisco.com (8.12.11/8.12.11) with ESMTP id m2VJgfPh019106; Mon, 31 Mar 2008 12:42:41 -0700
Received: from xbh-sjc-231.amer.cisco.com (xbh-sjc-231.cisco.com [128.107.191.100]) by sj-core-1.cisco.com (8.13.8/8.13.8) with ESMTP id m2VJgf5t022928; Mon, 31 Mar 2008 19:42:41 GMT
Received: from xmb-sjc-21b.amer.cisco.com ([171.70.151.143]) by xbh-sjc-231.amer.cisco.com with Microsoft SMTPSVC(6.0.3790.1830); Mon, 31 Mar 2008 12:42:41 -0700
X-MimeOLE: Produced By Microsoft Exchange V6.5
Content-class: urn:content-classes:message
MIME-Version: 1.0
Date: Mon, 31 Mar 2008 12:42:32 -0700
Message-ID: <D492339CC466C84EA5E0AF1CECB20081056842FA@xmb-sjc-21b.amer.cisco.com>
In-Reply-To: <7978BDEA-5A54-4A81-A7DF-FF6B72B99156@internet2.edu>
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
Thread-Topic: [ippm] WGLC for draft-ietf-ippm-twamp-06.txt
thread-index: AciTVszGd1Mj9cBYRRWGs3ASTxYB9wAD4CGg
References: <47C2C60C.9070807@ripe.net> <47DE8A2D.40409@ripe.net> <D492339CC466C84EA5E0AF1CECB200810561CCB4@xmb-sjc-21b.amer.cisco.com> <D492339CC466C84EA5E0AF1CECB2008105683E2F@xmb-sjc-21b.amer.cisco.com> <90EB10B5-EB5F-4364-910C-5E3ED6F607F4@internet2.edu> <D492339CC466C84EA5E0AF1CECB2008105683F23@xmb-sjc-21b.amer.cisco.com> <EDB3E3AC-CF06-4629-BCB4-7A45585E16F0@internet2.edu> <D492339CC466C84EA5E0AF1CECB2008105684036@xmb-sjc-21b.amer.cisco.com> <F4C4A17D-3B2D-4A35-8F18-071218D1DF5D@internet2.edu> <D492339CC466C84EA5E0AF1CECB20081056841F9@xmb-sjc-21b.amer.cisco.com> <7978BDEA-5A54-4A81-A7DF-FF6B72B99156@internet2.edu>
From: "Murtaza Chiba (mchiba)" <mchiba@cisco.com>
To: "Jeff W. Boote" <boote@internet2.edu>
X-OriginalArrivalTime: 31 Mar 2008 19:42:41.0667 (UTC) FILETIME=[62175530:01C89367]
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; l=2035; t=1206992561; x=1207856561; c=relaxed/simple; s=sjdkim2002; h=Content-Type:From:Subject:Content-Transfer-Encoding:MIME-Version; d=cisco.com; i=mchiba@cisco.com; z=From:=20=22Murtaza=20Chiba=20(mchiba)=22=20<mchiba@cisco.c om> |Subject:=20RE=3A=20[ippm]=20WGLC=20for=20draft-ietf-ippm-t wamp-06.txt |Sender:=20; bh=N26OgSDBfp7gRQHBs9SR4yIP3AQpsJm5vL/24+VlJiw=; b=0a9xW7JvO+5gMaQMQBE+6k9cQyj8GiCZvUv/TOmqXu/i4csUmLNhTBdR8A uPGit+7gHn20u2y55QCZ0kqO1PIUZaXlxcroO/cDRXHG3K5jS4Cv5sUKbutz 3Ghod8R+CD;
Authentication-Results: sj-dkim-2; header.From=mchiba@cisco.com; dkim=pass ( sig from cisco.com/sjdkim2002 verified; );
Cc: Henk Uijterwaal <henk@ripe.net>, IETF IPPM WG <ippm@ietf.org>
Subject: Re: [ippm] WGLC for draft-ietf-ippm-twamp-06.txt
X-BeenThere: ippm@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: IETF IP Performance Metrics Working Group <ippm.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/ippm>, <mailto:ippm-request@ietf.org?subject=unsubscribe>
List-Post: <mailto:ippm@ietf.org>
List-Help: <mailto:ippm-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/ippm>, <mailto:ippm-request@ietf.org?subject=subscribe>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Sender: ippm-bounces@ietf.org
Errors-To: ippm-bounces@ietf.org

Hi Jeff, 

> -----Original Message-----
> From: Jeff W. Boote [mailto:boote@internet2.edu] 
> Sent: Monday, March 31, 2008 10:44 AM
> To: Murtaza Chiba (mchiba)
> Cc: Henk Uijterwaal; IETF IPPM WG
> Subject: Re: [ippm] WGLC for draft-ietf-ippm-twamp-06.txt
> 
> Hi Murtaza,
> 
> On Mar 31, 2008, at 11:24 AM, Murtaza Chiba (mchiba) wrote:
> >> The optimization you suggest is not without a cost. If the 
> data going 
> >> into the HMAC and the result of the HMAC are both 
> transmitted in the 
> >> clear, the HMAC hash function is more susceptible to 
> attack. If this 
> >> level of optimization is required, I suggest using open mode.
> >>
> >
> > I agree that when using encrypted mode there is a reason to be 
> > paranoid and hence it is preferable to authenticate before 
> encryption.
> > How about the authenticated mode?   The reason to use an 
> authenticated
> > mode could be less to do with security (and hence 
> susceptibility) and 
> > more to do with data integrity.
> 
> Cracking the hash cracks it for the purposes of authenticated 
> mode as well. (For all test packets in the session.)
> 

Yes, but as I said, in authenticated mode the HMAC could be purely for
data integrity not security concerns.

Besides the concern for cracking is inconsistent with the Command
exchange authenticated mode that has no encryption.   Which leads one to
believe that authenticated mode is purely for integrity check.
Although, I agree that there will be fewer command exchanges, however,
admins tend to have same passwords across all devices!


-Murtaza




> Besides, I think it would be confusing to do it differently 
> in this one case, from all other cases in the protocol. I 
> think the intent of the RFC was clear and I don't see a good 
> reason to change it. However, I have nothing against an 
> errata to make it more clear.
> 
> jeff
> --
> Jeff W. Boote
> boote@internet2.edu
> 
> 
> 
> 
> 
_______________________________________________
ippm mailing list
ippm@ietf.org
https://www.ietf.org/mailman/listinfo/ippm

v2.23.0 | Report a Bug | By Email