Re: [IPsec] Ben Campbell's Yes on draft-ietf-ipsecme-rfc7321bis-05: (with COMMENT)

Hi Dave,

I don't have any strong feelings about MUST NOT vs. SHOULD NOT, but I wonder if it would help to clarify the reasoning behind it.

For these algorithms, RFC6071 (IPsec/IKE Roadmap) says:
- Reuse of the IV with the same key compromises the data's security; thus, AES-GCM should not be used with manual keying.
- Reuse of the IV with the same key and nonce compromises the data's security; thus, AES-CTR should not be used with manual keying.
- Reuse of the IV with the same key compromises the data's security; thus, AES-CCM should not be used with manual keying.
- Reuse of the salt value with the same key compromises the data's security; thus, AES-GMAC should not be used with manual keying.

Instead of just saying "these algorithms require IKE", could we give a slightly more detailed explanation? something like: "These algorithms require the use of an automated key negotiation protocol (e.g. IKE) to avoid reuse of important parameters, whose reuse compromises the algorithm's security." (Not the best wording, but you get the idea!)

But if you don't add this, I wouldn't object to publication of the RFC.

Sheila Frankel

________________________________
From: IPsec <ipsec-bounces@ietf.org> on behalf of Waltermire, David A. (Fed) <david.waltermire@nist.gov>
Sent: Thursday, March 16, 2017 1:14:33 PM
To: ipsec@ietf.org
Cc: draft-ietf-ipsecme-rfc7321bis@ietf.org; Ben Campbell; ipsecme-chairs@ietf.org; paul@nohats.ca; The IESG
Subject: Re: [IPsec] Ben Campbell's Yes on draft-ietf-ipsecme-rfc7321bis-05: (with COMMENT)

Comments below.

> -----Original Message-----
> From: Paul Wouters [mailto:paul@nohats.ca]
> Sent: Thursday, March 16, 2017 1:08 PM
> To: Ben Campbell <ben@nostrum.com>
> Cc: The IESG <iesg@ietf.org>; draft-ietf-ipsecme-rfc7321bis@ietf.org;
> ipsec@ietf.org; ipsecme-chairs@ietf.org; Waltermire, David A. (Fed)
> <david.waltermire@nist.gov>
> Subject: Re: [IPsec] Ben Campbell's Yes on draft-ietf-ipsecme-rfc7321bis-05:
> (with COMMENT)
>
> On Wed, 15 Mar 2017, Ben Campbell wrote:
>
> > -3: I wonder why "... is not to be used..." is not "... MUST NOT be
> > used...". But the section goes on to say if you do it anyway, you MUST
> > NOT use certain cryptosuites. So, does "... is not to be used..." mean
> > "SHOULD NOT"? Or is this one of those "MUST NOT BUT WE KNOW YOU
> WILL"
> > sort of requirements?
>
> It is indeed. I think a SHOULD NOT would actually be appropriate ?

Anyone in the WG have an opinion about making this change to SHOULD NOT? Please comment soon if you do.

Thanks,
Dave

_______________________________________________
IPsec mailing list
IPsec@ietf.org
https://www.ietf.org/mailman/listinfo/ipsec