Re: [IPsec] [Lwip] Review of draft-ietf-lwig-minimal-esp-00
Tero Kivinen <kivinen@iki.fi> Fri, 30 October 2020 19:26 UTC
Return-Path: <kivinen@iki.fi>
X-Original-To: ipsec@ietfa.amsl.com
Delivered-To: ipsec@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B08CF3A116E; Fri, 30 Oct 2020 12:26:33 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.347
X-Spam-Level:
X-Spam-Status: No, score=-2.347 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, NICE_REPLY_A=-0.247, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=iki.fi
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id CJjAeJ5j7L7Y; Fri, 30 Oct 2020 12:26:31 -0700 (PDT)
Received: from meesny.iki.fi (meesny.iki.fi [IPv6:2001:67c:2b0:1c1::201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 56FE43A116D; Fri, 30 Oct 2020 12:26:30 -0700 (PDT)
Received: from fireball.acr.fi (fireball.kivinen.iki.fi [IPv6:2001:1bc8:100d::2]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) (Authenticated sender: kivinen) by meesny.iki.fi (Postfix) with ESMTPSA id D759820AD3; Fri, 30 Oct 2020 21:26:26 +0200 (EET)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=iki.fi; s=meesny; t=1604085986; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=p4bcr5mDGgC4+UN5bjZjOQN6rANuAHsfk2XVtSwwbM8=; b=UzabmDrPxvLDe3iJCgJWOQcdRXFukajUwweHBtSCIOFfupy9JHhl8Wy1r736b9E0pCnTIz ng6BT6STViveGKC/XxJj4YksnDY5pNgoTdninipcNfVgELXeoCEbH9+ADwY9BJWvaDypYj G+Y19o8qj6plgmjxN4i/0wZL2AZhuvs=
Received: by fireball.acr.fi (Postfix, from userid 15204) id 9D4F625C131F; Fri, 30 Oct 2020 21:26:26 +0200 (EET)
MIME-Version: 1.0
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
Message-ID: <24476.26850.591422.567867@fireball.acr.fi>
Date: Fri, 30 Oct 2020 21:26:26 +0200
From: Tero Kivinen <kivinen@iki.fi>
To: Daniel Migault <mglt.ietf@gmail.com>
Cc: Valery Smyslov <smyslov.ietf@gmail.com>, IPsecME WG <ipsec@ietf.org>, lwip@ietf.org, Tobias Guggemos <tobias.guggemos@outlook.com>
In-Reply-To: <CADZyTknOJnY4fYzQDBYCOUwwDomLHJrxbWT7pMrDEhsgCt0nTw@mail.gmail.com>
References: <060501d5a9da$b8552490$28ff6db0$@gmail.com> <CADZyTknOJnY4fYzQDBYCOUwwDomLHJrxbWT7pMrDEhsgCt0nTw@mail.gmail.com>
X-Mailer: VM 8.2.0b under 26.3 (x86_64--netbsd)
X-Edit-Time: 5 min
X-Total-Time: 7 min
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=iki.fi; s=meesny; t=1604085986; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=p4bcr5mDGgC4+UN5bjZjOQN6rANuAHsfk2XVtSwwbM8=; b=Tgf1L8hjw0ETK2sluEXzdZUwk8cYA9mRnDi+ppyWSEsjzoZNbZG5P4ttVBuW6VEnAVzmPB AM1T/b0lAqbpyrfdFE0acpEEpkp6bcL4gD1mIDkic0UA/7Qq7xdfZQelPdtJRDOSV9Z8vT ISdlvsR3sIvitVuEWP9XNd4RDio2CLU=
ARC-Authentication-Results: i=1; ORIGINATING; auth=pass smtp.auth=kivinen smtp.mailfrom=kivinen@iki.fi
ARC-Seal: i=1; s=meesny; d=iki.fi; t=1604085986; a=rsa-sha256; cv=none; b=lMOadup9TRTfm4HQ0a7u/eCHxCRYR6tYIqY+wXRNfMajuFoDiz29Ou/ZH5S7qqnoNn1rPM 0uDsowJbConLIoVXdlKYnqnUvf7acPHPcPG43i2xgXYp4DHTi35rjT3/rPr/0JD+KkwKD/ 745gU69S1DcFr0+Cd1tkKUYTeeWArSU=
Archived-At: <https://mailarchive.ietf.org/arch/msg/ipsec/htLC8SWZTV9syAMUWYZb2ng4xuM>
Subject: Re: [IPsec] [Lwip] Review of draft-ietf-lwig-minimal-esp-00
X-BeenThere: ipsec@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Discussion of IPsec protocols <ipsec.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/ipsec>, <mailto:ipsec-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/ipsec/>
List-Post: <mailto:ipsec@ietf.org>
List-Help: <mailto:ipsec-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/ipsec>, <mailto:ipsec-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 30 Oct 2020 19:26:34 -0000
Daniel Migault writes: > value SN needs to be considered instead. Note that the limit of > messages being sent is primary determined by the security associated > to the key rather than the SN. The security of the key used to > encrypt decreases with the each message being sent and a node MUST > ensure the limit is not reached - even though the SN would permit it. > In a constrained environment, it is likely that the implementation of a > rekey mechanism is preferred over the use of ESN. No. The security of the key does not decrease, but the ability for the attacker to attack the key might incrase, and the value of attacking that one key also increases when more data is encrypted with it. Also with short block length algorithms there were stricter limits of data that can be encrypted with one key. -- kivinen@iki.fi
- [IPsec] Review of draft-ietf-lwig-minimal-esp-00 Valery Smyslov
- Re: [IPsec] Review of draft-ietf-lwig-minimal-esp… Daniel Migault
- Re: [IPsec] Review of draft-ietf-lwig-minimal-esp… Daniel Migault
- Re: [IPsec] [Lwip] Review of draft-ietf-lwig-mini… Tero Kivinen
- Re: [IPsec] [Lwip] Review of draft-ietf-lwig-mini… Daniel Migault