Re: [IPsec] Ben Campbell's Yes on draft-ietf-ipsecme-rfc7321bis-05: (with COMMENT)

[Eric Rescorla <[e-mail]>]

I agree with Russ.

On Mon, Jun 19, 2017 at 8:35 AM, Russ Housley <[e-mail]> wrote:

>
> > On Jun 19, 2017, at 11:26 AM, Paul Wouters <[e-mail]> wrote:
> >
> > On Mon, 19 Jun 2017, Eric Rescorla wrote:
> >
> >>      If manual keying is used anyway, AEAD algorithms MUST NOT be used,
> >>      as these algorithms require additional input provided by IKE and
> >>      are compromised if a counter is accidentally re-used, such as when
> >>      a counter overflows, or when a device reboots without remembering
> >>      the previously used counters. As of publication of this document,
> >>      ENCR_AES_CBC is the only non-AEAD Mandatory-To-Implement encryption
> >>      algorithm suitable for Manual Keying.
> >> It's not AEAD that's the problem here. After all, it's perfectly
> possible to do AEAD
> >> with CBC-HMAC. Rather, it's CTR mode.
> >
> >
> > Hmm, of course we only have CTR based AEAD's :P
> >
> > Ok, NEW NEW last paragraph:
> >
> >       If manual keying is used regardless, Counter Mode AEAD algorithms
> >       MUST NOT be used, as these algorithms require additional input
> >       provided by IKE and are compromised if a counter is accidentally
> >       re-used, such as when a counter overflows, or when a device reboots
> >       without remembering the previously used counters. As of publication
> >       of this document, ENCR_AES_CBC is the only Mandatory-To-Implement
> >       encryption algorithm suitable for Manual Keying.
>
> The Security Considerations in RFC 3686 point out the problems with using
> AES-CTR with static keys, which is what I think you mean by manual in this
> paragraph.  I think you need to delete “AEAD” from the first sentence or
> explain that CCM and GCM encompass counter mode.
>
> Russ
>
>