IETF Logo Mail Archive

Re: replay field size

Uri Blumenthal <uri@watson.ibm.com> Wed, 12 February 1997 19:01 UTC

Received: (from majordom@localhost) by portal.ex.tis.com (8.8.2/8.8.2) id OAA28313 for ipsec-outgoing; Wed, 12 Feb 1997 14:01:39 -0500 (EST)
From: Uri Blumenthal <uri@watson.ibm.com>
Message-Id: <9702121905.AA39146@hawpub.watson.ibm.com>
Subject: Re: replay field size
To: karn@qualcomm.com
Date: Wed, 12 Feb 1997 14:05:43 -0500
Cc: ipsec@tis.com
In-Reply-To: <199702120604.WAA21035@servo.qualcomm.com> from "Phil Karn" at Feb 11, 97 10:04:54 pm
Reply-To: uri@watson.ibm.com
X-Mailer: ELM [version 2.4 PL25]
Content-Type: text
Sender: owner-ipsec@ex.tis.com
Precedence: bulk

Phil Karn says:
> Make the replay counters 32 bits for both AH and ESP. Should be plenty
> for any rational key lifetime, and the arithmetic is easier on
> compilers without "long long" data types...

Probably.

> Shorten the SHA-1 hash to 128 bits. Probably won't be any worse than
> MD-5...

Actually, 128 bits of SHA-1 will be much better than 128 bits of MD5,
as it's more resistant to Preneel and van Orschott attack.
-- 
Regards,
Uri		uri@watson.ibm.com
-=-=-=-=-=-=-
<Disclaimer>

v2.28.0 | Report a Bug | By Email | System Status