RE: [Ipsec] Key length attribute (was: Important changes in draft-hoffman-rfc3664bis; please review)

Dan McDonald wrote:

> Except for one thing, yes it does.
> 
> That one thing:
> 
> 	- IKE is supposed to be algorithm-agile.  Let's say 
>         some grinning weirdo comes up with a better-than-AES 
>         algorithm, or worse, some other grinning weirdo breaks 
>         AES and we NEED a new cipher.
> 
> 	  How will we handle ciphers in the future?
> 
> There are two ways to solve this:
> 
> 	1.) All algorithms must have a default key length that 
>           is used when no key-length attribute is present.  
>           This means picking a default size for AES.
> 
> 	2.) All new algorithms with variable-sized keys are 
>           treated like AES, and MUST include a key-length 
>           attribute.
> 
> I don't care which one of those two is picked, but one of 
> them must be used to maintain algorithm-agility.

Option 1 would be an incompatible technical change to the 
current specification, so I'm not in favour of that one.

Option 2 sounds reasonable to me, but actually there are a 
couple of other options that would work as well:

3.) All new algorithms must allocate different transform numbers
    for different key lengths. E.g., when someone defines a new
    Really Great Encryption Algorithm (RGEA), we would allocate  
    two numbers for ENCR_RGEA128_CBC and ENCR_RGEA256_CBC.

4.) When a new algorithm with a variable-sized key is defined,
    the specification can choose which way to go: either it 
    defines a default key length (like Blowfish and RC5), or 
    it says that including the key length transform attribute
    is mandatory.

These are not totally exclusive; one algorithm could follow 2
and another algorithm 3 without problems...

There was actually some discussion about this issue before; see the
"AES Algorithm Negotiation in IKE" thread in Oct-Nov 2004.  The end
result of that discussion was that CTR/CCM/GCM use the key length
attribute just like CBC, but they define different transform IDs for
different ICV lengths (instead of defining a separate "ICV length"
transform attribute).

Best regards,
Pasi

_______________________________________________
Ipsec mailing list
Ipsec@ietf.org
https://www1.ietf.org/mailman/listinfo/ipsec