Re: [IPsec] Two questions about draft-ietf-ipsecme-chacha20-poly1305-00
Yoav Nir <ynir.ietf@gmail.com> Thu, 02 April 2015 15:05 UTC
Return-Path: <ynir.ietf@gmail.com>
X-Original-To: ipsec@ietfa.amsl.com
Delivered-To: ipsec@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D75721B2CC6 for <ipsec@ietfa.amsl.com>; Thu, 2 Apr 2015 08:05:47 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2
X-Spam-Level:
X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id skzuBRxJkXrs for <ipsec@ietfa.amsl.com>; Thu, 2 Apr 2015 08:05:46 -0700 (PDT)
Received: from mail-wg0-x230.google.com (mail-wg0-x230.google.com [IPv6:2a00:1450:400c:c00::230]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6F2651B2CF1 for <ipsec@ietf.org>; Thu, 2 Apr 2015 08:05:35 -0700 (PDT)
Received: by wgbdm7 with SMTP id dm7so88451824wgb.1 for <ipsec@ietf.org>; Thu, 02 Apr 2015 08:05:34 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=content-type:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=TgXNpmW1huXeUV2SkWe11CX7GPYoN5aWIE0b6zc+qr8=; b=BIpv3toBkxMly6grBNnxYbJZ4szKC05AcHPhjlf/BDztSIs2etkoZ+Tsy4+2NdvzW0 7bm686dQNX7GBUxW0gApfgzncuR37TdUVLYb0JEXDLeMH3DP9gZ694n+WqY+JEwPteIV E9PJaQRYufdKw9GJ+CpoUbu+nfHzhgl309nTKNinqXPEsIWGxZC2uKhgNNG31EUHBEmy SVRdKbTwt7paYzGYgOkYHW5yvb/XEe5EEpgpNoFz15u7qXtbRRJnl0US1e5pKnSPuabi CdqYQ4U/TfSWw/8as5lfb+FmrnhFAQz+1NisuHltbvufuALwXyVxaCUOHLIga/jqpc4e y5Lg==
X-Received: by 10.194.93.165 with SMTP id cv5mr97481549wjb.24.1427987134233; Thu, 02 Apr 2015 08:05:34 -0700 (PDT)
Received: from [172.24.250.177] (dyn32-131.checkpoint.com. [194.29.32.131]) by mx.google.com with ESMTPSA id ge8sm7622773wjc.32.2015.04.02.08.05.32 (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Thu, 02 Apr 2015 08:05:33 -0700 (PDT)
Content-Type: text/plain; charset="utf-8"
Mime-Version: 1.0 (Mac OS X Mail 8.2 \(2070.6\))
From: Yoav Nir <ynir.ietf@gmail.com>
In-Reply-To: <A113ACFD9DF8B04F96395BDEACB340420D056856@xmb-rcd-x04.cisco.com>
Date: Thu, 02 Apr 2015 18:05:31 +0300
Content-Transfer-Encoding: quoted-printable
Message-Id: <C9FF479F-AF95-4C60-AA43-7A3C0B0DA5D3@gmail.com>
References: <20150330133237.21486.80504.idtracker@ietfa.amsl.com> <6E938E70-324A-424E-9D20-7067BD278165@gmail.com> <A113ACFD9DF8B04F96395BDEACB340420D056856@xmb-rcd-x04.cisco.com>
To: "Scott Fluhrer (sfluhrer)" <sfluhrer@cisco.com>
X-Mailer: Apple Mail (2.2070.6)
Archived-At: <http://mailarchive.ietf.org/arch/msg/ipsec/4_sRn8Wv2llWw_E2hkhsTYDpilE>
Cc: "ipsec@ietf.org" <ipsec@ietf.org>
Subject: Re: [IPsec] Two questions about draft-ietf-ipsecme-chacha20-poly1305-00
X-BeenThere: ipsec@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Discussion of IPsec protocols <ipsec.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/ipsec>, <mailto:ipsec-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/ipsec/>
List-Post: <mailto:ipsec@ietf.org>
List-Help: <mailto:ipsec-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/ipsec>, <mailto:ipsec-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 02 Apr 2015 15:05:48 -0000
> On Mar 30, 2015, at 8:42 PM, Scott Fluhrer (sfluhrer) <sfluhrer@cisco.com> wrote: > > > -----Original Message----- > From: IPsec [mailto:ipsec-bounces@ietf.org] On Behalf Of Yoav Nir > Sent: Monday, March 30, 2015 10:40 AM > To: internet-drafts@ietf.org > Cc: ipsec@ietf.org; i-d-announce@ietf.org > Subject: [IPsec] Two questions about draft-ietf-ipsecme-chacha20-poly1305-00 > >> Hi, >> >> There is two questions I would like guidance from the group about. >> >> First is the nonce/IV question: In the current draft, there is a 64-bit IV with guidance not to repeat them (so use a counter or LFSR). The function itself accepts a 96-bit input nonce, so the nonce is constructed from the 64-bit IV and 32 zero bits. The reason for doing this is so the algorithm could be used in a multi-sender case such as GDOI, where the 32-bit zero can be replaced by a sender ID. > > This idea about the multi-sender case works only if the there's a sender id somewhere in the encrypted packet. You’re right. For some reason I thought that the SID in GDOI was implied rather than transmitted on the wire. Oh, well… >> Alternatively, we could generate a 32-bit salt value from the key material, but I don’t see a reason why we’d want that. > > Here's the reason that we do use the 32-bit salt value for GCM - to prevent batching attacks. > > Consider the case that an attacker is able to collect packets from a billion (2^30) sessions; each such session contains a packet with the same IV (say, IV=0), and contains a packet with the same known plaintext (or, at least, plaintext that satisfies the same known linear equations). Then, what an attacker can do is check a key to see if any of the IV=0 packets used that key, in constant time. The reduces the effort for an attacker to find the n bit key for some session from 2^n to 2^{n-30}. What the salt does is multiply the effort involved in this specific attack by a factor of 2^32 (because the attacker needs to guess the key and the salt); that way, the attacker needs to collect 4 billion sessions before this attack starts to have any advantage over a simpler attack that just attacks a single packet (which the salt doesn’t protect against). > > Now, of course, chacha20 has 256 bit keys; hence even if we decided not to apply the same protection, someone with a collection of a billion sessions might be able to use this to reduce the effort to 2^226. > > I'll let you decide whether this is a compelling argument or not… I think that for 256-bit keys it’s not that compelling. So the question is which is simpler: to do as AES-GCM does, or to set the salt to zero? Yoav
- [IPsec] I-D Action: draft-ietf-ipsecme-chacha20-p… internet-drafts
- [IPsec] Two questions about draft-ietf-ipsecme-ch… Yoav Nir
- Re: [IPsec] Two questions about draft-ietf-ipsecm… Yoav Nir
- Re: [IPsec] Two questions about draft-ietf-ipsecm… Scott Fluhrer (sfluhrer)
- [IPsec] Early code point assignment (was: I-D Act… Yoav Nir
- [IPsec] Two questions about draft-ietf-ipsecme-ch… Tero Kivinen
- Re: [IPsec] Early code point assignment (was: I-D… Yoav Nir
- Re: [IPsec] Early code point assignment (was: I-D… Paul Wouters
- Re: [IPsec] Early code point assignment (was: I-D… Yoav Nir
- Re: [IPsec] Early code point assignment (was: I-D… Paul Wouters
- Re: [IPsec] Early code point assignment (was: I-D… Tero Kivinen
- Re: [IPsec] Early code point assignment (was: I-D… Paul Wouters
- Re: [IPsec] Early code point assignment (was: I-D… Tero Kivinen
- Re: [IPsec] Early code point assignment (was: I-D… Yoav Nir
- Re: [IPsec] Early code point assignment (was: I-D… Paul Wouters
- Re: [IPsec] Early code point assignment Yaron Sheffer
- Re: [IPsec] Early code point assignment (was: I-D… Tero Kivinen
- Re: [IPsec] Two questions about draft-ietf-ipsecm… Yoav Nir
- Re: [IPsec] Two questions about draft-ietf-ipsecm… Yoav Nir
- Re: [IPsec] Two questions about draft-ietf-ipsecm… Yaron Sheffer
- Re: [IPsec] Two questions aboutdraft-ietf-ipsecme… Valery Smyslov
- Re: [IPsec] Two questions about draft-ietf-ipsecm… Michael Richardson