Re: [IPsec] Ben Campbell's Yes on draft-ietf-ipsecme-rfc7321bis-05: (with COMMENT)

[Russ Housley <[e-mail]>]

> On Jun 19, 2017, at 11:26 AM, Paul Wouters <[e-mail]> wrote:
> 
> On Mon, 19 Jun 2017, Eric Rescorla wrote:
> 
>>      If manual keying is used anyway, AEAD algorithms MUST NOT be used,
>>      as these algorithms require additional input provided by IKE and
>>      are compromised if a counter is accidentally re-used, such as when
>>      a counter overflows, or when a device reboots without remembering
>>      the previously used counters. As of publication of this document,
>>      ENCR_AES_CBC is the only non-AEAD Mandatory-To-Implement encryption
>>      algorithm suitable for Manual Keying.
>> It's not AEAD that's the problem here. After all, it's perfectly possible to do AEAD
>> with CBC-HMAC. Rather, it's CTR mode.
> 
> 
> Hmm, of course we only have CTR based AEAD's :P
> 
> Ok, NEW NEW last paragraph:
> 
>       If manual keying is used regardless, Counter Mode AEAD algorithms
>       MUST NOT be used, as these algorithms require additional input
>       provided by IKE and are compromised if a counter is accidentally
>       re-used, such as when a counter overflows, or when a device reboots
>       without remembering the previously used counters. As of publication
>       of this document, ENCR_AES_CBC is the only Mandatory-To-Implement
>       encryption algorithm suitable for Manual Keying.

The Security Considerations in RFC 3686 point out the problems with using AES-CTR with static keys, which is what I think you mean by manual in this paragraph.  I think you need to delete “AEAD” from the first sentence or explain that CCM and GCM encompass counter mode.

Russ