Re: [IPsec] Ben Campbell's Yes on draft-ietf-ipsecme-rfc7321bis-05: (with COMMENT)

[Paul Wouters <[e-mail]>]

On Mon, 19 Jun 2017, Eric Rescorla wrote:

>       If manual keying is used anyway, AEAD algorithms MUST NOT be used,
>       as these algorithms require additional input provided by IKE and
>       are compromised if a counter is accidentally re-used, such as when
>       a counter overflows, or when a device reboots without remembering
>       the previously used counters. As of publication of this document,
>       ENCR_AES_CBC is the only non-AEAD Mandatory-To-Implement encryption
>       algorithm suitable for Manual Keying.
> 
> 
> It's not AEAD that's the problem here. After all, it's perfectly possible to do AEAD
> with CBC-HMAC. Rather, it's CTR mode.


Hmm, of course we only have CTR based AEAD's :P

Ok, NEW NEW last paragraph:

        If manual keying is used regardless, Counter Mode AEAD algorithms
        MUST NOT be used, as these algorithms require additional input
        provided by IKE and are compromised if a counter is accidentally
        re-used, such as when a counter overflows, or when a device reboots
        without remembering the previously used counters. As of publication
        of this document, ENCR_AES_CBC is the only Mandatory-To-Implement
        encryption algorithm suitable for Manual Keying.

Paul